Download Firefox

Firefox is no longer supported on Windows 8.1 and below.

Please download Firefox ESR (Extended Support Release) to use Firefox.

Firefox is no longer supported on macOS 10.14 and below.

Please download Firefox ESR (Extended Support Release) to use Firefox.

Firefox Privacy Notice

Mozilla Foundation Security Advisory 2006-72

XSS by setting img.src to javascript: URI

Announced
December 19, 2006
Reporter
moz_bug_r_a4
Impact
High
Products
Firefox, SeaMonkey, Thunderbird
Fixed in
  • Firefox 1.5.0.9
  • Firefox 2.0.0.1
  • SeaMonkey 1.0.7
  • Thunderbird 1.5.0.9

Description

moz_bug_r_a4 reported that the src attribute of an IMG element loaded in a frame could be changed to a javascript: URI that was able to bypass the protections against cross-site script (XSS) injection. The injected script could steal credentials and financial data, or perform destructive actions on behalf of a logged-in user.

Workaround

Disable JavaScript until you can upgrade to a fixed version.

References

Exploit details withheld until after the active update period.