Security Directorate

Security Advisories & Vulnerability Policy

Public CVE bulletins, upstream patch monitoring, and our 24-hour turnaround SLA for critical browser vulnerabilities.

Responsible Disclosure

Vulnerability Disclosure Policy

The Navavritti Foundation welcomes responsible, good-faith vulnerability reports from security researchers and developers. We provide complete safe harbor protection for ethical security research conducted against Nivara components.

Reporting Vulnerabilities:

Email encrypted reports to: security@navavritti.org

PGP Fingerprint: 9E4A 8F21 C73D 5B19 042E 8A6F 3D84 2C91 5F6A 7B8C

Patch Turnaround SLA

Critical (CVSS 9.0–10.0 / Zero-Day):
24 Hours (Immediate hotfix & out-of-band release)

High (CVSS 7.0–8.9):
72 Hours

Medium / Low:
Next scheduled release (Within 14 days)

Public Bulletin

Published Security Advisories

Audited security fixes and mitigation records for Nivara Browser releases.

NSA-2026-001 CVE-2026-2189 medium

Fixed in v1.0.0

Memory Safety Hardening in WebRender Glyph Cache

A bounded buffer indexing condition in GPU glyph texture upload was identified and patched prior to release.

During routine internal fuzzing of the WebRender texture cache subsystem, our security team identified a boundary calculation issue in custom bitmap fonts. The patch was backported and upstreamed to the Gecko repository.