Sandbox escape due to incorrect boundary conditions in the Telemetry component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.
oryginał ENCVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:HMozilla Firefox
APPMozilla< 115.34.0< 149.0128.0 – 140.9.0 (bez)
🔵
ZWERYFIKUJ U PRODUCENTA
Brak jednoznacznych danych o patchu. Sprawdź referencje od producenta.
Referencje
Powiązane podatności
CVE-2024-9680CRITICAL9.8⚠ KEVPL ✓ten sam produkt
Use-after-free w Animation timelines Firefox/Thunderbird — RCE
CVE-2022-26486CRITICAL9.6⚠ KEVten sam produkt
An unexpected message in the WebGPU IPC framework could lead to a use-after-free and exploitable sandbox escap...
CVE-2019-11708CRITICAL10.0⚠ KEVten sam produkt
Insufficient vetting of parameters passed with the Prompt:Open IPC message between child and parent processes ...
CVE-2010-3765CRITICAL9.8⚠ KEVten sam produkt
Mozilla Firefox 3.5.x through 3.5.14 and 3.6.x through 3.6.11, Thunderbird 3.1.6 before 3.1.6 and 3.0.x before...
CVE-2026-14241CRITICAL9.8ten sam produkt
Memory safety bugs present in Firefox 152.0.3. Some of these bugs showed evidence of memory corruption and we ...