• Security Center
  • Security Advisories
  • Known Vulnerabilities
  • Bug Bounty
  • Security Blog

You are here: Security Center > Mozilla Foundation Security Advisories > MFSA 2013-60

Mozilla Foundation Security Advisory 2013-60

Title: getUserMedia permission dialog incorrectly displays location
Impact: Moderate
Announced: June 25, 2013
Reporter: Matt Wobensmith
Products: Firefox

Fixed in: Firefox 22.0

Description

Mozilla engineer Matt Wobensmith discovered that when the getUserMedia permission dialog for an iframe appears in one domain, it will display its origin as that of the top-level document and not the calling framed page. This could lead to users incorrectly giving camera or microphone permissions when confusing the requesting page's location for a hosting one's.

References

• Domain displayed permission dialog matches URL location bar, not content (CVE-2013-1698)