← All credits
Axel Chong (@Haxatron)
4 vulnerability records and advisories credit this contributor.
CVE-2025-8042
Sandboxed iframe could start downloads
CVE-2025-11716
Sandboxed iframes allowed links to open in external apps (Android only)
CVE-2023-4047
A bug in popup notifications delay calculation could have made it possible for an attacker to trick a user into granting permissions. This vulnerability affects Firefox < 116, Firefox ESR < 102.14, and Firefox ESR < 115.1.
CVE-2023-29545
Similar to CVE-2023-28163, this time when choosing 'Save Link As', suggested filenames containing environment variable names would have resolved those in the context of the current user.
*This bug only affects Firefox and Thunderbird on Windows. Other v