Anne Van Kesteren

The issue is related to a lack of protection for service worker data, which could allow a remote attacker to disclose protected information through the use of dynamic `import()`. This affects Firefox and Firefox ESR browsers.

The issue is related to Service Workers in browsers, which could allow a remote attacker to infer information about the presence or length of a media file by exploiting timing information for cross-origin media combined with Range requests.

A security issue was found in the iframe sandbox element with the allow-popups flag, which could be bypassed when using noopener links. This could lead to security problems for websites that rely on sandbox configurations allowing popups and hosting arbitrary content. The vulnerability is related to incorrect default access permission settings.

The issue is related to memory safety bugs and buffer copying without checking the size of input data, which could potentially be exploited to run arbitrary code. This may lead to memory corruption.

The issue is related to the lack of same-origin protections for response header name interning, allowing stored header names to be available cross-origin. This could potentially enable a remote attacker to gain unauthorized access to protected information.

A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML via a multibyte character set. This can be exploited by remote attackers.