356 matches found
Firefox-CVE-2024-9680
Firefox CVE-2024-9680 CVE-2024-9680 Description An attacker was able to achieve code execution in the content process by exploiting a use-after-free in Animation timelines. We have had reports of this vulnerability being exploited in the wild. This vulnerability affects Firefox 131.0.2, Firefox E...
CVE-2026-74939-escape-the-mac-n-cheese-box
CVE-2026-74939 — Firefox content→parent privilege escalation Proof of concept for a sandbox escape in Firefox 149.0a1 nightly 2fbc0748c4, pre-fix. A compromised content process forges an IPDL message that makes the parent load a page into a privileged privilegedabout process. This is the stage-2...
CVE-2026-4692-trust-me-im-in-rdm
CVE-2026-4692 — content processes can declare themselves in RDM Proof of concept for a missing authorization check on BrowsingContext field synchronization: a compromised content process forges a PContent::CommitBrowsingContextTransaction message setting InRDMPane = true on its own top-level...
CLEANSTART-2024-BH66439 compromised content process could have performed session history manipulations it should not have been able to due to testing infrastructure that was not restricted to testing-only configurations
Security vulnerability affects the librewolf package. A compromised content process could have performed session history manipulations it should not have been able to due to testing infrastructure that was not restricted to testing-only configurations...
CLEANSTART-2024-DY60209 compromised content process could send a message to the parent process that would cause the 'Click to Play' permission prompt to be shown
Security vulnerability affects the firefox package. A compromised content process could send a message to the parent process that would cause the 'Click to Play' permission prompt to be shown...
CLEANSTART-2024-VK74022 When constructing a permission prompt for WebRTC, a URI was supplied from the content process
Security vulnerability affects the firefox package. When constructing a permission prompt for WebRTC, a URI was supplied from the content process...
CLEANSTART-2024-UQ28182 compromised content process could have performed session history manipulations it should not have been able to due to testing infrastructure that was not restricted to testing-only configurations
Security vulnerability affects the firefox package. A compromised content process could have performed session history manipulations it should not have been able to due to testing infrastructure that was not restricted to testing-only configurations...
CLEANSTART-2024-UQ62409 By generally accepting and passing resource handles across processes, a compromised content process might have confused higher privileged processes to interact with handles that the unprivileged pr...
Security vulnerability affects the firefox package. By generally accepting and passing resource handles across processes, a compromised content process might have confused higher privileged processes to interact with handles that the unprivileged process should not have access to...
Astra Linux – vulnerability in Firefox
Privilege escalation in the DOM: Content Process component. This vulnerability has been fixed in Firefox 153 and Thunderbird 153...
Astra Linux – Vulnerability in Firefox
A compromised content process could have performed session history manipulations that it should not have been able to due to a testing infrastructure that wasn’t restricted to only testing configurations. This vulnerability affects Firefox versions less than 88...
Exploit for Improper Isolation or Compartmentalization in Mozilla Firefox
CVE-2026-4692 — content processes can declare themselves in RD...
Exploit for Improper Privilege Management in Mozilla Firefox
CVE-2026-74939 — Firefox content→parent privilege escalation...
CVE-2026-74986
Site isolation issue in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1...
GHSA-V5X7-VHWF-5V44 vulnerabilities
Vulnerabilities for packages: firefox...
PT-2026-71993
Name of the Vulnerable Software and Affected Versions Grav API plugin getgrav/grav-plugin-api versions prior to 1.0.13 Description An API key scope-cap bypass exists in the guardTwigContent function within PagesController. The issue occurs because the Twig-toggle check relies on a basic...
WebKit single-bug RCE: crafted web content yields AAR/AAW/PC-hijack in content process
Summary A memory-corruption vulnerability in Apple's WebKit engine is reachable from maliciously crafted web content. Apple's public advisory understates the impact as an "unexpected process crash" and notes it was addressed with improved memory handling. In practice the bug is a single-shot remo...
MiracleLinux 8 : thunderbird-102.11.0-1.el8.ML.1 (AXSA:2023-6153:18)
The remote MiracleLinux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2023-6153:18 advisory. Mozilla: Browser prompts could have been obscured by popups CVE-2023-32205 Mozilla: Crash in RLBox Expat driver CVE-2023-32206 Mozilla: Potential...
EUVD-2019-3435
Malware in sbrugna...