Vulnerabilities

A potential vulnerability leading to an integer overflow can occur during buffer size calculations for images when a raw value is used instead of the checked value.

Limitations on the URIs allowed to WebExtensions by the browser.windows.create API can be bypassed when a pipe in the URL field is used within the extension to load multiple pages as a single argument.

When the RSS Feed preview about:feeds page is framed within another page, it can be used in concert with scripted content for a clickjacking attack that confuses users into downloading and executing an executable file fr…

WebExtension content scripts can be loaded into about: pages in some circumstances, in violation of the permissions granted to extensions.

A same-origin policy violation allowing the theft of cross-origin URL entries when using the Javascript location property to cause a redirection to another site using performance.getEntries().

A buffer overflow can occur in the Skia library during buffer offset calculations with hardware accelerated canvas 2D actions due to the use of 32-bit calculations instead of 64-bit.

A use-after-free vulnerability can occur after deleting a selection element due to a weak reference to the select element in the options collection.

A buffer overflow occurs when drawing and validating elements with the ANGLE graphics library, used for WebGL content, when working with the VertexBuffer11 module.

Mozilla developers and community members reported memory safety bugs present in Firefox 63.

Mozilla developers and community members reported memory safety bugs present in Firefox 63 and Firefox ESR 60.3.