336 matches found
Firefox-CVE-2024-9680
Firefox CVE-2024-9680 CVE-2024-9680 Descripción Un atacante logró ejecutar código en el proceso de contenido explotando un use-after-free en las líneas de tiempo de animación CSS. Hemos recibido informes de que esta vulnerabilidad está siendo explotada activamente. Esta vulnerabilidad afecta a...
CVE-2026-4692-trust-me-im-in-rdm
CVE-2026-4692 — 内容进程可在 RDM 中声明自身 针对 BrowsingContext 字段同步缺失授权检查的概念验证：一个被攻破的内容进程伪造 PContent::CommitBrowsingContextTransaction 消息，在其自身的顶层 BrowsingContext 上设置 InRDMPane = true，而父进程直接应用了该设置 。 目标：Firefox 149.0a1 nightly @ 2fbc0748c4（存在漏洞，修复前版本），macOS arm64。 已在 Firefox 149 中修复 — bug 2017643，提交...
CVE-2026-74939-escape-the-mac-n-cheese-box
CVE-2026-74939 — Firefox content→parent 权限提升 针对 Firefox 149.0a1 nightly（2fbc0748c4，修复前）中沙箱逃逸的概念验证。受入侵的 content 进程伪造一条 IPDL 消息，使 parent 进程将页面加载到 特权 （privilegedabout）进程中。 这是第二阶段沙箱逃逸，设计用于在 content 进程 RCE（例如 CVE-2026-2796）之后进行链接利用。 该漏洞（Mozilla bug 2054416） Parent 进程从 content→parent 的 IPDL 消息中反序列化...
Astra Linux – Vulnerability in Firefox
A compromised content process could have performed session history manipulations that it should not have been able to due to a testing infrastructure that wasn’t restricted to only testing configurations. This vulnerability affects Firefox versions less than 88...
Exploit for Improper Isolation or Compartmentalization in Mozilla Firefox
CVE-2026-4692 — content processes can declare themselves in RD...
Exploit for Improper Privilege Management in Mozilla Firefox
CVE-2026-74939 — Firefox content→parent privilege escalation...
CVE-2026-74986
Site isolation issue in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1...
GHSA-V5X7-VHWF-5V44 vulnerabilities
Vulnerabilities for packages: firefox...
PT-2026-71993
Name of the Vulnerable Software and Affected Versions Grav API plugin getgrav/grav-plugin-api versions prior to 1.0.13 Description An API key scope-cap bypass exists in the guardTwigContent function within PagesController. The issue occurs because the Twig-toggle check relies on a basic...
WebKit single-bug RCE: crafted web content yields AAR/AAW/PC-hijack in content process
Summary A memory-corruption vulnerability in Apple's WebKit engine is reachable from maliciously crafted web content. Apple's public advisory understates the impact as an "unexpected process crash" and notes it was addressed with improved memory handling. In practice the bug is a single-shot remo...
MiracleLinux 8 : thunderbird-102.11.0-1.el8.ML.1 (AXSA:2023-6153:18)
The remote MiracleLinux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2023-6153:18 advisory. Mozilla: Browser prompts could have been obscured by popups CVE-2023-32205 Mozilla: Crash in RLBox Expat driver CVE-2023-32206 Mozilla: Potential...
EUVD-2019-7495
Malware in sbrugna...
EUVD-2018-16948
Malware in sbrugna...
EUVD-2019-7489
Malware in sbrugna...
EUVD-2019-3435
Malware in sbrugna...
EUVD-2023-57506
Malicious code in bioql PyPI...
EUVD-2022-49652
Malicious code in bioql PyPI...
EUVD-2023-57505
Malicious code in bioql PyPI...