tag
Firefox
Firefox SpiderMonkey JIT Miscompilation and Use-After-Free (CVE-2026-2764)
CVE-2026-2764 is a JIT miscompilation vulnerability in Firefox SpiderMonkey (IonMonkey/Baseline) that leads to type confusion and use-after-free. On new Ctor(...arr) / Reflect.construct with a Proxy as newTarget, the proxy get trap fires while the engine is…
Firefox/Tor Browser IndexedDB Ordering Fingerprint — CVE-2026-6770
Prior to the fix, Firefox's indexedDB.databases() API returned database names in an implementation-specific (non-alphabetically-sorted) internal order rather than a canonical sorted order. Because this ordering can vary based on subtle…
Firefox Smart Window Private URL Exfiltration
Firefox's Smart Window assistant exposes getopentabs and searchbrowsinghistory tools that return private tab/history URLs to the model and mark the conversation as containing privateData, but they never mark it as containing untrustedInput even though the…