zx

Invalid pointer, undefined behavior in the DOM: Notifications component

Mint HTTP/2 client buffers oversized frames up to 16 MiB before enforcing max_frame_size

Mint HTTP/1 client applies chunked framing when chunked is not the final transfer coding, enabling response smuggling through intermediaries

Private action arguments can be set by user input on the bulk destroy and bulk update paths in Ash

Sandbox escape due to incorrect boundary conditions in the Networking component

Incorrect boundary conditions in the Audio/Video: Web Codecs component

JIT miscompilation in the JavaScript Engine: JIT component

Cross-compartment wrappers wrapping a scripted proxy could have caused objects from other compartments to be stored in the main compartment resulting in a use-after-free. This vulnerability affects Firefox < 115, Firefox ESR < 102.13, and Thunderbird < 10