Vulnerabilities

The AES-GCM implementation in WebCrypto API accepts 0-length IV when it should require a length of 1 according to the NIST Special Publication 800-38D specification.

A vulnerability where WebExtensions can download and attempt to open a file of some non-executable file types.

The "instanceof" operator can bypass the Xray wrapper mechanism.

A spoofing vulnerability can occur when a page switches to fullscreen mode without user notification, allowing a fake address bar to be displayed.

WebExtensions could use popups and panels in the extension UI to load an "about:" privileged URL, violating security checks that disallow this behavior.

On pages containing an iframe, the "data:" protocol can be used to create a modal dialog through Javascript that will have an arbitrary domains as the dialog's location, spoofing of the origin of the modal dialog from th…

Inside the JavaScript parser, a cast of an integer to a narrower type can result in data read from outside the buffer being parsed.

If web content on a page is dragged onto portions of the browser UI, such as the tab bar, links can be opened that otherwise would not be allowed to open.

Memory safety bugs were reported in Firefox 55.