a missing bound check in pale moon CPAL validation lets a web font read past its heap allocation and leak the bytes through canvas pixels
auditing tor browser 15 safer for wasm leftovers: a local file:// worker keeps WebAssembly.compile while https workers do not
