Maurice Dauer

Missing authorization in the BackgroundFetch component allows a remote attacker to bypass the web origin policy, which is a security mechanism that restricts how a document or script loaded from one origin can interact with a resource from another origin, by using a crafted HTML page.

Memory safety bugs exist that exhibit evidence of memory corruption. These issues could potentially be exploited to execute arbitrary code.

Memory safety bugs exist that exhibit evidence of memory corruption, which could potentially be exploited to execute arbitrary code.

Memory safety bugs involving memory corruption could allow an attacker to run arbitrary code.

The software contains memory safety bugs that could potentially lead to arbitrary code execution. Some of these bugs demonstrate evidence of memory corruption.

The software contains memory safety bugs that exhibit evidence of memory corruption. It is presumed that, with sufficient effort, these bugs could be exploited to execute arbitrary code.

Name of the Vulnerable Software and Affected Versions: Firefox versions prior to 142 Thunderbird versions prior to 142 Description: Memory safety bugs are present in Firefox 141 and Thunderbird 141. Some of these bugs showed evidence of memory corruption, and it is presumed that with sufficient effort, some of them could have been exploited to run arbitrary code. Recommendations: Update Firefox to version 142 or later. Update Thunderbird to version 142 or later.

The issue is related to an inappropriate implementation in the Background Fetch API, allowing a remote attacker to leak cross-origin data via a crafted HTML page. This could potentially expose sensitive information.

Memory safety bugs are present, showing evidence of memory corruption. It is presumed that with enough effort, some of these bugs could be exploited to run arbitrary code.

Memory safety bugs have been detected in Firefox and Thunderbird, showing evidence of memory corruption. It is presumed that with sufficient effort, some of these bugs could have been exploited to run arbitrary code.

The issue is related to insufficient policy enforcement in the Extensions API, which could allow an attacker to bypass existing security restrictions. This could be achieved by convincing a user to install a malicious extension and then using a crafted HTML page to circumvent downloads policy.

The issue is related to insufficient policy enforcement in cookies, allowing a remote attacker to leak cross-origin data via a crafted HTML page. This can be exploited by a specially designed website, potentially revealing protected information. The estimated number of potentially affected devices worldwide is not specified.

The issue is related to insufficient policy enforcement in the Background Fetch component of Google Chrome and Microsoft Edge browsers. This can be exploited by a remote attacker using a specially crafted web page to leak protected information. The exploitation allows the attacker to disclose cross-origin data.

The issue is related to insufficient policy enforcement in CORS, allowing a remote attacker to leak cross-origin data via a crafted HTML page. This can enable the attacker to bypass security restrictions and gain unauthorized access to protected information.

The issue is related to an inappropriate implementation in the Background Fetch API, which allowed a remote attacker to leak cross-origin data via a crafted HTML page. This could enable an attacker to gain unauthorized access to protected information. The vulnerability is associated with incorrectly implemented security checks for standard elements.

The issue is related to insufficient policy enforcement in the background fetch feature, allowing a remote attacker to bypass the same origin policy. This can be achieved via a crafted HTML page, potentially leading to unauthorized access to protected information.

The issue is related to an inappropriate implementation in the Background Fetch API, which can allow a remote attacker to leak cross-origin data via a crafted HTML page. This can lead to unauthorized access to protected information.

The issue is related to an inappropriate implementation in the Background Fetch API, allowing a remote attacker to leak cross-origin data via a crafted HTML page. This could enable an attacker to gain unauthorized access to protected information.