VulnerableCode Package Details - pkg:alpm/archlinux/firefox@88.0-1

Search for packages

Vulnerability	Summary	Fixed by
VCID-ndp1-5bhw-8kau Aliases: CVE-2021-29952	When Web Render components were destructed, a race condition could have caused undefined behavior, and we presume that with enough effort may have been exploitable to run arbitrary code.	88.0.1-1 Affected by 9 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }}
VCID-qm3n-zmh9-afgy Aliases: CVE-2021-29953	By triggering multiple pop-up prompts containing javascript: URLs, a malicious webpage could have forced a Firefox for Android user into executing attacker-controlled JavaScript in the context of another domain, resulting in a Universal Cross-Site Scripting vulnerability.Note: This issue only affected Firefox for Android. Other operating systems are unaffected.	There are no reported fixed by versions.

Vulnerability

Summary

Fixed by

VCID-ndp1-5bhw-8kau
Aliases:
CVE-2021-29952

When Web Render components were destructed, a race condition could have caused undefined behavior, and we presume that with enough effort may have been exploitable to run arbitrary code.

88.0.1-1
Affected by 9 other vulnerabilities.

VCID-qm3n-zmh9-afgy
Aliases:
CVE-2021-29953

By triggering multiple pop-up prompts containing javascript: URLs, a malicious webpage could have forced a Firefox for Android user into executing attacker-controlled JavaScript in the context of another domain, resulting in a Universal Cross-Site Scripting vulnerability.*Note: This issue only affected Firefox for Android. Other operating systems are unaffected.*

There are no reported fixed by versions.

Vulnerability	Summary	Aliases
VCID-1e61-jk2b-aubw	Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could result in the arbitrary execution of code.	CVE-2021-23994
VCID-2cd3-m37k-5ydh	Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could result in the arbitrary execution of code.	CVE-2021-29946
VCID-7ddz-65jt-pudk	Due to unexpected data type conversions, a use-after-free could have occurred when interacting with the font cache. We presume that with enough effort this could have been exploited to run arbitrary code.	CVE-2021-23997
VCID-8jkx-ad5d-e7cd	A compromised content process could have performed session history manipulations it should not have been able to due to testing infrastructure that was not restricted to testing-only configurations.	CVE-2021-24001
VCID-e38r-grgp-rfbn	Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could result in the arbitrary execution of code.	CVE-2021-23998
VCID-e6xd-fmsu-jkgn	A race condition with requestPointerLock() and setTimeout() could have resulted in a user interacting with one tab when they believed they were on a separate tab. In conjunction with certain elements (such as <input type="file">) this could have led to an attack where a user was confused about the origin of the webpage and potentially disclosed information they did not intend to.	CVE-2021-24000
VCID-ebus-cbbm-u3dn	Mozilla developers and community members Ryan VanderMeulen, Sean Feng, Tyson Smith, Julian Seward, Christian Holler reported memory safety bugs present in Firefox 87. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.	CVE-2021-29947
VCID-qq5h-5k45-rycm	Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could result in the arbitrary execution of code.	CVE-2021-23995
VCID-rmzq-gwbe-qyba	By utilizing 3D CSS in conjunction with Javascript, content could have been rendered outside the webpage's viewport, resulting in a spoofing attack that could have been used for phishing or other attacks on a user.	CVE-2021-23996
VCID-tjtk-gghp-1kdf	Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could result in the arbitrary execution of code.	CVE-2021-23999
VCID-vt2f-abwe-4ba2	Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could result in the arbitrary execution of code.	CVE-2021-24002

Vulnerability

Summary

Aliases

VCID-1e61-jk2b-aubw

Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could result in the arbitrary execution of code.

CVE-2021-23994

VCID-2cd3-m37k-5ydh

Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could result in the arbitrary execution of code.

CVE-2021-29946

VCID-7ddz-65jt-pudk

Due to unexpected data type conversions, a use-after-free could have occurred when interacting with the font cache. We presume that with enough effort this could have been exploited to run arbitrary code.

CVE-2021-23997

VCID-8jkx-ad5d-e7cd

A compromised content process could have performed session history manipulations it should not have been able to due to testing infrastructure that was not restricted to testing-only configurations.

CVE-2021-24001

VCID-e38r-grgp-rfbn

Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could result in the arbitrary execution of code.

CVE-2021-23998

VCID-e6xd-fmsu-jkgn

A race condition with requestPointerLock() and setTimeout() could have resulted in a user interacting with one tab when they believed they were on a separate tab. In conjunction with certain elements (such as <input type="file">) this could have led to an attack where a user was confused about the origin of the webpage and potentially disclosed information they did not intend to.

CVE-2021-24000

VCID-ebus-cbbm-u3dn

Mozilla developers and community members Ryan VanderMeulen, Sean Feng, Tyson Smith, Julian Seward, Christian Holler reported memory safety bugs present in Firefox 87. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.

CVE-2021-29947

VCID-qq5h-5k45-rycm

Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could result in the arbitrary execution of code.

CVE-2021-23995

VCID-rmzq-gwbe-qyba

By utilizing 3D CSS in conjunction with Javascript, content could have been rendered outside the webpage's viewport, resulting in a spoofing attack that could have been used for phishing or other attacks on a user.

CVE-2021-23996

VCID-tjtk-gghp-1kdf

Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could result in the arbitrary execution of code.

CVE-2021-23999

VCID-vt2f-abwe-4ba2

Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could result in the arbitrary execution of code.

CVE-2021-24002

Date	Actor	Action	Vulnerability	Source	VulnerableCode Version
2026-04-07T13:59:12.592547+00:00	Arch Linux Importer	Fixing	VCID-1e61-jk2b-aubw	https://security.archlinux.org/AVG-1834	38.1.0
2026-04-07T13:59:12.581035+00:00	Arch Linux Importer	Fixing	VCID-qq5h-5k45-rycm	https://security.archlinux.org/AVG-1834	38.1.0
2026-04-07T13:59:12.569739+00:00	Arch Linux Importer	Fixing	VCID-rmzq-gwbe-qyba	https://security.archlinux.org/AVG-1834	38.1.0
2026-04-07T13:59:12.558971+00:00	Arch Linux Importer	Fixing	VCID-7ddz-65jt-pudk	https://security.archlinux.org/AVG-1834	38.1.0
2026-04-07T13:59:12.544679+00:00	Arch Linux Importer	Fixing	VCID-e38r-grgp-rfbn	https://security.archlinux.org/AVG-1834	38.1.0
2026-04-07T13:59:12.532778+00:00	Arch Linux Importer	Fixing	VCID-tjtk-gghp-1kdf	https://security.archlinux.org/AVG-1834	38.1.0
2026-04-07T13:59:12.520956+00:00	Arch Linux Importer	Fixing	VCID-e6xd-fmsu-jkgn	https://security.archlinux.org/AVG-1834	38.1.0
2026-04-07T13:59:12.508353+00:00	Arch Linux Importer	Fixing	VCID-8jkx-ad5d-e7cd	https://security.archlinux.org/AVG-1834	38.1.0
2026-04-07T13:59:12.496335+00:00	Arch Linux Importer	Fixing	VCID-vt2f-abwe-4ba2	https://security.archlinux.org/AVG-1834	38.1.0
2026-04-07T13:59:12.482913+00:00	Arch Linux Importer	Fixing	VCID-2cd3-m37k-5ydh	https://security.archlinux.org/AVG-1834	38.1.0
2026-04-07T13:59:12.471184+00:00	Arch Linux Importer	Fixing	VCID-ebus-cbbm-u3dn	https://security.archlinux.org/AVG-1834	38.1.0
2026-04-07T13:59:12.457593+00:00	Arch Linux Importer	Affected by	VCID-ndp1-5bhw-8kau	https://security.archlinux.org/AVG-1917	38.1.0
2026-04-01T18:25:37.446148+00:00	Arch Linux Importer	Fixing	VCID-1e61-jk2b-aubw	https://security.archlinux.org/AVG-1834	38.0.0
2026-04-01T18:25:37.417965+00:00	Arch Linux Importer	Fixing	VCID-qq5h-5k45-rycm	https://security.archlinux.org/AVG-1834	38.0.0
2026-04-01T18:25:37.394661+00:00	Arch Linux Importer	Fixing	VCID-rmzq-gwbe-qyba	https://security.archlinux.org/AVG-1834	38.0.0
2026-04-01T18:25:37.371285+00:00	Arch Linux Importer	Fixing	VCID-7ddz-65jt-pudk	https://security.archlinux.org/AVG-1834	38.0.0
2026-04-01T18:25:37.347251+00:00	Arch Linux Importer	Fixing	VCID-e38r-grgp-rfbn	https://security.archlinux.org/AVG-1834	38.0.0
2026-04-01T18:25:37.321697+00:00	Arch Linux Importer	Fixing	VCID-tjtk-gghp-1kdf	https://security.archlinux.org/AVG-1834	38.0.0
2026-04-01T18:25:37.296154+00:00	Arch Linux Importer	Fixing	VCID-e6xd-fmsu-jkgn	https://security.archlinux.org/AVG-1834	38.0.0
2026-04-01T18:25:37.273067+00:00	Arch Linux Importer	Fixing	VCID-8jkx-ad5d-e7cd	https://security.archlinux.org/AVG-1834	38.0.0
2026-04-01T18:25:37.249020+00:00	Arch Linux Importer	Fixing	VCID-vt2f-abwe-4ba2	https://security.archlinux.org/AVG-1834	38.0.0
2026-04-01T18:25:37.222432+00:00	Arch Linux Importer	Fixing	VCID-2cd3-m37k-5ydh	https://security.archlinux.org/AVG-1834	38.0.0
2026-04-01T18:25:37.195018+00:00	Arch Linux Importer	Fixing	VCID-ebus-cbbm-u3dn	https://security.archlinux.org/AVG-1834	38.0.0
2026-04-01T18:25:34.681832+00:00	Arch Linux Importer	Affected by	VCID-ndp1-5bhw-8kau	https://security.archlinux.org/AVG-1917	38.0.0
2026-04-01T18:24:17.038927+00:00	Arch Linux Importer	Affected by	VCID-qm3n-zmh9-afgy	https://security.archlinux.org/AVG-1918	38.0.0

2026-04-07T13:59:12.592547+00:00

Arch Linux Importer

Fixing

Next non-vulnerable version	89.0.1-1
Latest non-vulnerable version	101.0-1
Risk	4.5