Mozilla Foundation Security Advisory 2005-13
Window Injection Spoofing
- Announced
- February 24, 2005
- Reporter
- Secunia
- Risk
- Low
- Impact
- Low
- Products
- Firefox, Mozilla Suite
- Fixed in
-
- Firefox 1.0.1
- Mozilla Suite 1.7.6
Description
A website can inject content into a popup opened by another site if the target name of the popup window is known. An attacker who knows you are going to visit that other site could spoof the contents of the popup.
Open windows can now be targeted by name only by the site whose content is in the window and the site which opened the window if different. Other sites attempting to target the same named window will instead get a new unnamed window.
Workaround
Do not browse trusted sites after browsing untrusted sites