Mozilla Foundation Security Advisory 2010-10
Title: XSS via plugins and unprotected Location object
Announced: March 23, 2010
Reporter: Blake Kaplan
Products: Firefox 3.6
Fixed in: Firefox 3.6.2
Mozilla developer Blake Kaplan reported that the
in the Firefox 3.6 browser engine (Gecko 1.9.2) because new mechanisms
were developed to enforce the same-origin policy between windows and frames.
This object is unfortunately also used by some plugins to determine the page
origin used for access restrictions. A malicious page could override this
object to fool a plugin into granting access to data on another site or the
local file system. The behavior of older Firefox versions has been restored.
This flaw does not affect earlier versions of Firefox, or other programs such as Thunderbird or SeaMonkey built on older versions of the browser engine.