Firefox Community Forum

Hi, During some tests I found that FF 115.19.0esr can still execute arbitrary JS similarly to CVE-2024-4367. I’ve checked the versions and > 115.11esr should be patched. Any payload with ‘/JS’ taken from https://github.com/luigigubello/PayloadsAllThePDFs/tree/main will do. Since this is probably important – FontMatrix is *not* working (no JS), original PoC (https://codeanlabs.com/wp-content/uploads/2024/05/poc_generalized_CVE-2024-4367.pdf) is also *not* working. I also wasn’t able to call an external script and so far haven’t found any path to exploit it beyond an alertbox. However, it still bothers me a lot and I’d like to know whether it’s the correct, expected behavior with FF+pdf.js, is it a vulnerability, or maybe my browser was somehow corrupted or is using some other mechanism that’s not within your control (my settings? about:config?).

Steps to re-create: 1. Open file in notepad 2. Add ‘/OpenAction 99 0 R’ after ‘lang’ in ‘1 0 obj section’ 3. After ‘endobj’ add ‘99 0 obj <</Type /Action /S /JavaScript /JS (app.alert\(1\);)>>’ 4. Result – alertbox popping twice

Hello,

So, I got the "Restart to keep using Firefox message" while working to make sure that certain HIPPA protected data. I cannot close out of the browser because I am in an incognito window.

Is there a way to pause the message or can I only prevent it by disabling automatic updates?

P.S. So I work in the very sensitive part of Data Engineering e911 that deals with medical patient reports that given ONLY to the doctor at the hospital when the fire department drops you off at a Hospital. Because of extremely sensitive nature some of the specific report fields, I am not longer legally allowed (by HIPPA as old as the law is) to use browsers like chrome. So, I have to use browser like Firefox that are still in compliance. I want Firefox to update, but I want to choose when it updates (on the first weekend when there is a national fire or storm disaster happening... which technically will be this first Saturday since the update on the 15th).

I have a 2023 MacBook Pro and a Synology NAS. Fairly recently, when I have tried to access the web site for the NAS using Firefox, I have received the following error message: "Unable to connect. An error occurred during a connection to [the IP address].” I am able to access the web site using the Safari and Bing browsers, and I also am able to access the web site using Firefox on an iPad. I already have contacted Apple and Synology support personnel, and have been that the issue is not with either Apple or Synology products. Please let me of any potential solutions to this problem that Mozilla may have.

I'd like to take a full-page screenshot of my content within my Canvas/Instructure online class, but it only captures what's visible. I've tried opening the frame in its own tab, but it doesn't help.

When I use my phone to capture the entire page, it can work, but it's so narrow! Plus I have to continuously tap the "Scroll Down" button for the capturing process to capture more and more.

Can anyone please help? Thanks.

I have deleted Norton from my wife's Win7 PC, but it still tries to "help" when she is logging on to various web sites. How do we get Norton off of her Firefox?? Her Firefox is current version.

Thank you for any help.

Ron Olsen

I upgraded Firefox using Ubuntu's apt update, apt dist-upgrade. The upgrade process said my version is 134.0.1 but when I look on the Help button is says my version is 125.0.2. How do I upgrade to 134.0.1?

Hello, I use my providers web email promail.ptd.net , but they don't have where I can add a sound to incoming email or specific ones.. I did add the promail to your notifications,settings, but can you explain to me what the step would be to get their incoming email to make a sound of choice while using Firefox? or do i have to switch to an email program that already has that option? I wish Eudora would continue!

bold text My default browser changed and I can't reset it to firefox. Also, the firefox logo doesn't show when I open Firefox. bold text

Ever since Facebook started infesting the chats with end-to-end encryption (random chats get "Messenger upgraded the security of this chat. Messages and calls are secured with end-to-end encryption" without my permission or asking if I want this), any encrypted chats have audio and video calls disabled. I note that I have ONE friend for whom it didn't do this, I can still do calls with her. If I receive a call, I get a pop-up saying that to receive this call I must download the Messenger app (no way) or a browser which supports it. If I check what browsers it thinks supports this, it only lists Chrome and Edge. As far as I know Edge is just Internet Explorer renamed, the biggest black hole in security, I've never touched it. Chrome ignores industry standards, so I don't use it. Making Firefox the best, top browser available. It's the only browser I wish to use. Mozilla needs to look into how to get Facebook to stop blacklisting Firefox like this. Note that this E2EE garbage has only been infecting things for the last few months, before that I was perfectly able to do any calls I wished in Facebook Messenger.

Several of my financial accounts give me this error with Firefox. I had to go to Edge to get my tax documents. I'd much rather have a way to get to my sites without leaving Firefox.

HSTS required

Other websites may require HTTP Strict Transport Security (HSTS) and will not allow access with an insecure connection.

I have opened a Firefox Account with a password. My Apple credentials are not syncing with my Firefox account. I created my password today for that reason I don't need to reset another password based on principle and keeping things simple. However I do have a Gmail account with Mozilla therefore I may be able to edit my accounts that way. I will also need to update and sync my Apple keychain passwords with my Firefox account. Thank You

You haven't provided an off switch for this "thumbnail preview image of the webpage" on my taskbar? I don't want anything dropping down from my task bar on hovering over it.

This is a new thing, that Firefox for some reason thought was a good idea. Mouse hovering on my taskbar, and have a drop down thumbnail preview image of the webpage?

Thank you all in advance...  :)