113821 matches found
CVE-2025-1939
Android apps can load web pages using the Custom Tabs feature. This feature supports a transition animation that could have been used to trick a user into granting sensitive permissions by hiding what the user was actually clicking. This vulnerability affects Firefox 136...
DEBIAN-CVE-2025-1935
A web page could trick a user into setting that site as the default handler for a custom URL protocol. This vulnerability was fixed in Firefox 136, Firefox ESR 128.8, Thunderbird 136, and Thunderbird 128.8...
CVE-2025-1939
Android apps can load web pages using the Custom Tabs feature. This feature supports a transition animation that could have been used to trick a user into granting sensitive permissions by hiding what the user was actually clicking. This vulnerability was fixed in Firefox 136...
CVE-2025-1935
A web page could trick a user into setting that site as the default handler for a custom URL protocol. This vulnerability was fixed in Firefox 136, Firefox ESR 128.8, Thunderbird 136, and Thunderbird 128.8...
UBUNTU-CVE-2025-1935
A web page could trick a user into setting that site as the default handler for a custom URL protocol. This vulnerability affects Firefox 136, Firefox ESR 128.8, Thunderbird 136, and Thunderbird 128.8...
UBUNTU-CVE-2025-1939
Android apps can load web pages using the Custom Tabs feature. This feature supports a transition animation that could have been used to trick a user into granting sensitive permissions by hiding what the user was actually clicking. This vulnerability affects Firefox 136...
CVE-2025-1935 Clickjacking the registerProtocolHandler info-bar
A web page could trick a user into setting that site as the default handler for a custom URL protocol. This vulnerability was fixed in Firefox 136, Firefox ESR 128.8, Thunderbird 136, and Thunderbird 128.8...
CVE-2025-1935
A web page could trick a user into setting that site as the default handler for a custom URL protocol. This vulnerability affects Firefox < 136 , Firefox ESR < 128.8 , Thunderbird < 136 , and Thunderbird
CVE-2025-1939
Android apps can load web pages using the Custom Tabs feature. This feature supports a transition animation that could have been used to trick a user into granting sensitive permissions by hiding what the user was actually clicking. This vulnerability was fixed in Firefox 136...
CVE-2025-1939 Tapjacking in Android Custom Tabs using transition animations
Android apps can load web pages using the Custom Tabs feature. This feature supports a transition animation that could have been used to trick a user into granting sensitive permissions by hiding what the user was actually clicking. This vulnerability was fixed in Firefox 136...
CVE-2025-1939
The Firefox web browser (versions prior to 136 ) is vulnerable to a tapjacking flaw within the Custom Tabs feature. The issue stems from transition animations that could be manipulated to hide the actual UI elements being clicked, potentially tricking users into granting sensitive permissions . T...
CVE-2025-1939 Tapjacking in Android Custom Tabs using transition animations
Android apps can load web pages using the Custom Tabs feature. This feature supports a transition animation that could have been used to trick a user into granting sensitive permissions by hiding what the user was actually clicking. This vulnerability was fixed in Firefox 136...
Malicious code in vue-custom-widget-template1 (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 21b54ec1679cbeb92bfd2aaa272446918c32899d07a1fc5e4211c07323790f26 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in v1ue-custom-widget-template (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3f7e56b04ae3ca44fba371adba340a3933b9fb3e7899bc2da0a2c868373970b5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2025-2117 Malicious code in my-custom-vue-widget (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 45c516cbd7bda6255ce1f5a2b53f65970a24bb84aa4fc373041f73a440b8ae41 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2025-2138 Malicious code in vue-custom-widget-template1 (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 21b54ec1679cbeb92bfd2aaa272446918c32899d07a1fc5e4211c07323790f26 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in product-custom-grid-columns (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 620dece457b625966cbf804fa1e8bcd8b54fb2b961020453940961af4569f10d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2025-2067 Malicious code in product-custom-grid-columns (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 620dece457b625966cbf804fa1e8bcd8b54fb2b961020453940961af4569f10d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Security Vulnerabilities fixed in Thunderbird 136 — Mozilla
Certain crafted MIME email messages that claimed to contain an encrypted OpenPGP message, which instead contained an OpenPGP signed message, were wrongly shown as being encrypted. When requesting an OpenPGP key from a WKD server, an incorrect padding size was used and a network observer could hav...
Security Vulnerabilities fixed in Firefox ESR 128.8 — Mozilla
In resizeToAtLeast of SkRegion.cpp, there was a possible out of bounds write due to an integer overflow On Windows, a compromised content process could use bad StreamData sent over AudioIPC to trigger a use-after-free in the Browser process. This could have led to a sandbox escape. It was possibl...