Download Firefox

Firefox is no longer supported on Windows 8.1 and below.

Please download Firefox ESR (Extended Support Release) to use Firefox.

Firefox is no longer supported on macOS 10.14 and below.

Please download Firefox ESR (Extended Support Release) to use Firefox.

Firefox Privacy Notice

Mozilla Foundation Security Advisory 2008-48

Image stealing via canvas and HTTP redirect

Announced
November 12, 2008
Reporter
Georgi Guninski, Michal Zalewski, Chris Evans
Impact
High
Products
Firefox, SeaMonkey, Thunderbird
Fixed in
  • Firefox 2.0.0.18
  • SeaMonkey 1.1.13
  • Thunderbird 2.0.0.18

Description

Mozilla developer Georgi Guninski reported that the canvas element could be used in conjunction with an HTTP redirect to bypass same-origin restrictions and gain access to the content in arbitrary images from other domains. This vulnerability could be used by an attacker to steal private information from a victim who is logged into a website that stores the data in images.

Security researchers Michal Zalewski and Chris Evans also reported an additional threat caused by this vulnerability in which an attacker can enumerate the software installed on a victim's computer by using moz-icon as the redirection target.

Firefox 3 is not affected by this issue.

References