An issue in NetSurf v3.11 causes the application to read uninitialized heap memory when creating a dom_event structure.

An issue in NetSurf v.3.11 allows a remote attacker to execute arbitrary code via the dom_node_normalize function

NetSurf 3.11 is vulnerable to Use After Free in dom_node_set_text_content function.

Information-disclosure vulnerability in Netsurf through 2.8 due to a world-readable cookie jar.