firefox security

A subtle bug in how Firefox and Thunderbird handled cross-site navigations inside nested iframes allowed browsers to incorrectly include SameSite=Strict or SameSite=Lax cookies in situations where they should have been withheld, creating a window for cookie leakage and session abuse. The issue...

A relatively obscure browser interaction — dragging and dropping content — turned into a tangible security risk when Mozilla disclosed CVE-2023-37203: an insufficient validation flaw in the Drag and Drop API that, when combined with social engineering, could trick users into creating shortcuts...

Firefox 125 contained multiple memory-safety defects that Mozilla’s fuzzing team judged serious enough to potentially allow arbitrary code execution; the issues were fixed in Firefox 126 (MFSA2024-21), and any installation running Firefox < 126 (including affected ESR/Thunderbird builds) should...

When a Firefox user encountered a network error while loading a page, the browser could leave the previous page’s content visible while showing an empty address bar — a confusing state that attackers could use to hide the real destination and attempt a spoofing attack. The bug, tracked as...