Version 3.6.2 addresses several security issues, including critical flaws. A long list of bugs was also resolved. The security fixes include:

• A critical fix to a WOFF (Web Open Font Format) heap corruption caused by an integer overflow in a font decompression routine. An attacker could use this vulnerability to crash a victim’s browser and execute arbitrary code.
• Critical fixes to crashes with evidence of memory corruption, which could be used to run arbitrary code.
• A solution to a critical vulnerability in Web Worker array handling, which could be used to corrupt heap memory and run arbitrary code.
• A critical fix to prevent the HTML parser from incorrectly freeing used memory, resulting in the possible execution of arbitrary code.
• A repair to a XSS (Cross-Site Scripting) vulnerability when using an SVG (Scalable Vector Graphics) document and binary Content-Type.
• A repair to a XSS vulnerability due to window.dialogArguments being readable, even when from a different domain.

The entire list of fixes can be accessed from these release notes.