Mozilla Firefox security vulnerabilities

A security vulnerability exists in Mozilla Firefox versions prior to 159, Mozilla Firefox ESR versions prior to 115.44, Mozilla Firefox ESR versions prior to 153.6, Mozilla Thunderbird versions prior to 159, and Mozilla Thunderbird versions prior to 153.6. This vulnerability stems from a...

Mozilla Firefox security vulnerabilities

Mozilla Firefox has a security vulnerability stemming from post-free reuse in its DOM: Core & HTML components...

Mozilla Firefox security vulnerabilities

Mozilla Firefox has a security vulnerability stemming from a use-after-free issue in its DOM: Core & HTML components, which may lead to memory corruption or crashes...

Mozilla Firefox security vulnerabilities

A security vulnerability exists in Mozilla Firefox versions prior to 159, Mozilla Firefox ESR versions prior to 115.44 and 153.6, as well as Mozilla Thunderbird versions prior to 153.6 and 159. This vulnerability stems from use-after-free issues in the DOM Editor component, which may lead to memo...

Mozilla Firefox security vulnerabilities

A security vulnerability exists in Mozilla Firefox versions prior to 159, Firefox ESR versions prior to 153.6, Thunderbird versions prior to 159, and Thunderbird versions prior to 153.6. This vulnerability stems from a site isolation issue related to the Navigation component within DOM, potential...

Mozilla Firefox security vulnerabilities

Security vulnerabilities exist in Mozilla Firefox versions prior to 159, Firefox ESR versions prior to 153.6, Thunderbird versions prior to 159, and Thunderbird versions prior to 153.6. These vulnerabilities stem from issues in the DOM’s UI Events & Focus Handling component and may lead to...

CVE-2026-116803 DOMPurify before 3.4.17 DOM XSS via IN_PLACE Hook-Detached Subtrees

DOMPurify before 3.4.17 contains a cross-site scripting vulnerability that allows attackers to keep event handlers armed when an INPLACE hook removes a parent or sibling node. Attacker markup in detached subtrees is never walked or neutralized, so handlers like img onerror fire after sanitize...

CVE-2026-116803

DOMPurify versions prior to 3.4.17 are vulnerable to a DOM-based Cross-Site Scripting (XSS) vulnerability. The root cause is that the library fails to neutralize event handlers in detached subtrees when an IN_PLACE hook removes a parent or sibling node. Consequently, handlers (such as img onerror...

CVE-2026-116803 DOMPurify before 3.4.17 DOM XSS via IN_PLACE Hook-Detached Subtrees

DOMPurify before 3.4.17 contains a cross-site scripting vulnerability that allows attackers to keep event handlers armed when an INPLACE hook removes a parent or sibling node. Attacker markup in detached subtrees is never walked or neutralized, so handlers like img onerror fire after sanitize...

CVE-2026-116803 DOMPurify before 3.4.17 DOM XSS via IN_PLACE Hook-Detached Subtrees

DOMPurify before 3.4.17 contains a cross-site scripting vulnerability that allows attackers to keep event handlers armed when an INPLACE hook removes a parent or sibling node. Attacker markup in detached subtrees is never walked or neutralized, so handlers like img onerror fire after sanitize...

Chromium CVE-2026-110913: Memory corruption in DOM

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

CVE-2026-112865

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WProyal Royal Elementor Addons royal-elementor-addons allows DOM-Based XSS.This issue affects Royal Elementor Addons: from n/a through 1.7.1069...

CVE-2026-112865 WordPress Royal Elementor Addons plugin <= 1.7.1069 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WProyal Royal Elementor Addons royal-elementor-addons allows DOM-Based XSS.This issue affects Royal Elementor Addons: from n/a through 1.7.1069...

CVE-2026-112865 WordPress Royal Elementor Addons plugin <= 1.7.1069 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WProyal Royal Elementor Addons royal-elementor-addons allows DOM-Based XSS.This issue affects Royal Elementor Addons: from n/a through 1.7.1069...

CVE-2026-112865

The WProyal Royal Elementor Addons (royal-elementor-addons) plugin for WordPress is vulnerable to a DOM-Based Cross-Site Scripting (XSS) flaw due to improper neutralization of input during web page generation. This vulnerability affects versions from n/a through 1.7.1069 . Exploitation details an...

EUVD-2026-109714

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WProyal Royal Elementor Addons royal-elementor-addons allows DOM-Based XSS.This issue affects Royal Elementor Addons: from n/a through 1.7.1069...

freeipa: ipa: FreeIPA/IdM: Cross-Site Scripting vulnerability allows arbitrary code execution via crafted URL

A flaw was found in FreeIPA. An unauthenticated remote attacker could exploit a DOM Cross-Site Scripting XSS vulnerability in the FreeIPA/IdM Web UI password reset page. By enticing a victim to click a specially crafted link and complete a password reset, the attacker could inject and execute...

firefox: Use-after-free in the DOM: Bindings (WebIDL) component

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the DOM: Bindings WebIDL component...

firefox: Use-after-free in the DOM: Core & HTML component

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the DOM: Core & HTML component...

firefox: Sandbox escape due to uninitialized memory in the DOM: Web Serial component

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Sandbox escape due to uninitialized memory in the DOM: Web Serial component...