You are here: Security Center > Mozilla Foundation Security Advisories > MFSA 2013-06

Mozilla Foundation Security Advisory 2013-06

Title: Touch events are shared across iframes
Impact: Moderate
Announced: January 8, 2013
Reporter: Wesley Johnston
Products: Firefox, SeaMonkey

Fixed in: Firefox 18.0
  SeaMonkey 2.15

Description

Mozilla developer Wesley Johnston reported that when there are two or more iframes on the same HTML page, an iframe is able to see the touch events and their targets that occur within the other iframes on the page. If the iframes are from the same origin, they can also access the properties and methods of the targets of other iframes but same-origin policy (SOP) restricts access across domains. This allows for information leakage and possibilities for cross-site scripting (XSS) if another vulnerability can be used to get around SOP restrictions.

These touch events are only currently used in Firefox for Android and other products should not be exposed these this vulnerability.

References