Atte Kettunen

A buffer overflow exists in ANGLE, a compatibility layer that allows OpenGL ES APIs to run on non-native platforms. This flaw allows a remote attacker to execute arbitrary code outside the sandbox by inducing the user to visit a specially crafted HTML page.

The Audio/Video: Web Codecs component contains incorrect boundary conditions.

An issue exists in the Graphics: WebGPU component due to incorrect boundary conditions.

An issue exists in the Graphics: WebGPU component due to incorrect boundary conditions.

An attacker could have caused a use-after-free via the `Custom Highlight API`, leading to a potentially exploitable crash.

The issue is related to the manipulation of the selection node cache, which may cause unexpected behavior and potentially lead to an exploitable crash. This could allow a remote attacker to cause a denial of service. The vulnerability is associated with incorrect clearance or release of resources in the Selection Node Cache component of Mozilla Firefox.

The issue is related to the use of `nsIInputStream` interfaces in Firefox, Firefox ESR, and Thunderbird, which could lead to a use-after-free condition and potentially exploitable crash. This could allow a remote attacker to execute arbitrary code.

A malicious webpage could cause an out-of-bounds write in WebGL, leading to memory corruption and a potentially exploitable crash. The issue is related to buffer copying without checking the size of input data in the WebGL API for 3D graphics in browsers. Exploitation of this issue may allow a remote attacker to cause a denial of service using a specially crafted malicious webpage.

The issue is related to a heap-buffer-overflow that could lead to a potentially exploitable crash, caused by applying a CSS filter effect that accesses out of bounds memory. This could allow a remote attacker to execute arbitrary code in the target system by exploiting the buffer overflow vulnerability in the `blendGaussianBlur` function of the affected software.

The issue is related to a use-after-free error, which occurs when memory is accessed after it has been freed. This could potentially lead to a crash and allow a remote attacker to cause a denial of service. The estimated number of potentially affected devices worldwide is not specified.

A buffer overflow can occur in the Skia library during buffer offset calculations with hardware accelerated canvas 2D actions due to the use of 32-bit calculations instead of 64-bit, resulting in a potentially exploitable crash. The issue is related to a buffer overflow in the Skia library, which may allow a remote attacker to execute arbitrary code or cause a denial of service.

The issue is related to an integer overflow leading to use after free in PDFium, which can potentially allow a remote attacker to exploit heap corruption via a crafted PDF file.

The issue is related to improper handling of objects in memory, which could allow a remote attacker to execute arbitrary code in the context of the current user by using a specially crafted website. If the current user has administrative rights, the attacker could gain control of the affected system, enabling them to install programs, view, change, or delete data, or create new accounts with full user rights.

A segmentation fault can occur in the Skia graphics library during some canvas operations due to issues with mask/clip intersection and empty masks.

A buffer overflow read occurs during SVG filter color value operations, resulting in data exposure.

A segmentation fault can occur during some bidirectional layout operations.

A buffer overflow in the WebGL component of the affected browsers and email client can be triggered by web content, potentially resulting in a crash. This issue may allow a remote attacker to cause a denial of service.

A memory corruption issue in Skia can occur when using transforms to make gradients, resulting in a potentially exploitable crash.

A buffer overflow in SkiaGl occurs when a GrGLBuffer is truncated during allocation, potentially leading to a crash when later writers overflow the buffer.

The issue incorrectly handled object lifecycles during shutdown, allowing a remote attacker to perform an out of bounds memory read via crafted HTML pages.