Hafiizh

A use after free issue in Compositing allows a remote attacker to execute arbitrary code inside the sandbox by inducing the user to visit a crafted HTML page. Use after free is a memory corruption flaw that occurs when an application continues to use a pointer after it has been freed.

A race condition in ANGLE allows a remote attacker to potentially execute arbitrary code outside the sandbox by using a crafted HTML page. A race condition occurs when the timing or sequence of events is unplanned, leading to unexpected behavior.

A security issue exists that allows attackers to affect the system.

A use-after-free issue exists in the Input component. This flaw allows a remote attacker who has already compromised the renderer process to potentially execute arbitrary code outside the sandbox by using a specially crafted HTML page. Use-after-free is a memory corruption flaw that occurs when an application continues to use a pointer after it has been freed.

A spoofing issue exists within the Downloads component, which could allow an attacker to deceive users by misrepresenting the source or nature of a downloaded file.

A clickjacking issue exists in the Downloads component. Clickjacking is a technique where an attacker uses multiple transparent or semi-transparent layers to trick a user into clicking on a button or link on the page when they were intending to click on something else.

Clickjacking issue in Firefox for Android. Clickjacking is a technique where an attacker uses multiple transparent or semi-transparent layers to trick a user into clicking on a button or link on another page when they were intending to click on the top-level page.

A clickjacking issue exists in the WebExtensions component. Clickjacking is a technique where an attacker uses multiple transparent or semi-transparent layers to trick a user into clicking on a button or link on another page when they were intending to click on the top-level page.

An issue exists where the user interface misrepresents critical information, which could allow an unauthorized attacker to perform spoofing over a network.

A spoofing issue exists within the Form Autofill component.

A spoofing issue exists in the WebAuthn component in Firefox for Android. This issue affects Firefox and Thunderbird.

An improper implementation in the Downloads feature allows a remote attacker to perform UI spoofing through a specially crafted HTML page. The Chromium security severity is rated as Low.

Incorrect security UI in the Tab Strip allows a remote attacker to perform domain spoofing, which is the act of disguising a website to appear as a different, trusted domain, by using a crafted HTML page.

A flaw exists in the Digital Credentials component of the Google Chrome browser due to improper restriction of rendered user interface layers. Remote attackers may be able to compromise the integrity of protected information by exploiting this issue.

Incorrect security UI in Tab Hover Cards allows a remote attacker to perform domain spoofing by using a crafted domain name.

The software contains a flaw.

A flaw exists in the Split View component of the Google Chrome browser related to errors in how information is presented in the user interface. Remote exploitation of this issue could allow an attacker to conduct spoofing attacks.

Name of the Vulnerable Software and Affected Versions: Firefox for iOS versions prior to 142 Focus for iOS versions prior to 142 Description: Malicious pages could exploit Firefox for iOS to pass FIDO links to the operating system, triggering the hybrid passkey transport. An attacker within Bluetooth range could potentially trick a user into using their passkey to log the attacker’s computer into the target account. Recommendations: Update Firefox for iOS to version 142 or later. Update Focus for iOS to version 142 or later.

Name of the Vulnerable Software and Affected Versions: Firefox versions prior to 140 Description: The exception page for the HTTPS-Only feature, displayed when a website is opened via HTTP, lacked an anti-clickjacking delay, potentially allowing an attacker to trick a user into granting an exception and loading a webpage over HTTP. Recommendations: For versions prior to 140, update to version 140 or later to resolve the issue. As a temporary workaround, consider being cautious when granting exceptions for websites, especially when accessing them via HTTP, to minimize the risk of exploitation.

A specially crafted filename containing a large number of encoded newline characters could obscure the file's extension when displayed in the download dialog. This issue affects Firefox for Android and Thunderbird.