Manipulating individual parts of a URL object could have caused an out-of-bounds read leaking process memory to malicious JavaScript. This vulnerability affects Firefox ESR < 68.10 Firefox < 78 and Thunderbird < 68.10.0.