An attacker could have caused a use-after-free via crafted XSLT
data, leading to a potentially exploitable crash.
An attacker could have caused a use-after-free via the Custom
Highlight API, leading to a potentially exploitable crash.
A race during concurrent delazification could have led to a
use-after-free.
Memory safety bugs present in Firefox 134, Thunderbird 134, Firefox
ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19, and Thunderbird
128.6. Some of these bugs showed evidence of memory corruption and
we presume that with enough effort some of these could have been
exploited to run arbitrary code.