Vulnerabilities

An issue with incorrect ownership model of "privateBrowsing" information exposed through developer tools.

A potential memory corruption and crash when using Skia content when drawing content outside of the bounds of a clipping region.

If a page is loaded from an original site through a hyperlink and contains a redirect to a "data:text/html" URL, triggering a reload will run the reloaded "data:text/html" page with its origin set incorrectly.

Android intents can be used to launch Firefox for Android in reader mode with a user specified URL.

When a "javascript:" URL is drag and dropped by a user into the addressbar, the URL will be processed and executed.

A mechanism to bypass file system access protections in the sandbox using the file system request constructor through an IPC message.

The internal feed reader APIs that crossed the sandbox barrier allowed for a sandbox escape and escalation of privilege if combined with another vulnerability that resulted in remote code execution inside the sandboxed p…

A mechanism to bypass file system access protections in the sandbox to use the file picker to access different files than those selected in the file picker through the use of relative paths.

A mechanism to inject static HTML into the RSS reader preview page due to a failure to escape characters sent as URL parameters for a feed's "TITLE" element.

Malicious sites can display a spoofed addressbar on a page when the existing location bar on the new page is scrolled out of view if an HTML editable page element is user selected.

A mechanism to spoof the addressbar through the user interaction on the addressbar and the "onblur" event.

A mechanism to spoof the Firefox for Android addressbar using a "javascript:" URI.

A possibly exploitable crash triggered during layout and manipulation of bidirectional unicode text in concert with CSS animations.

Memory safety bugs were reported in Firefox 52, Firefox ESR 52, and Thunderbird 52.