Vulnerabilities

Memory safety bugs present in Firefox 126, Firefox ESR 115.11, and Thunderbird 115.11.

By manipulating the text in an `<input>` tag, an attacker could have caused corrupt memory leading to a potentially exploitable crash.

Offscreen Canvas did not properly track cross-origin tainting, which could be used to access image data from another site in violation of same-origin policy.

On Windows 10, when using the 'Save As' functionality, an attacker could have tricked the browser into saving the file with a disallowed extension such as `.url` by including an invalid character in the extension.

By tricking the browser with a `X-Frame-Options` header, a sandboxed iframe could have presented a button that, if clicked by a user, would bypass restrictions to open a new window.

By monitoring the time certain operations take, an attacker could have guessed which external protocol handlers were functional on a user's system.

If a garbage collection was triggered at the right time, a use-after-free could have occurred during object transplant.

Memory corruption in the networking stack could have led to a potentially exploitable crash.