Download Firefox

Firefox is no longer supported on Windows 8.1 and below.

Please download Firefox ESR (Extended Support Release) to use Firefox.

Firefox is no longer supported on macOS 10.14 and below.

Please download Firefox ESR (Extended Support Release) to use Firefox.

Firefox Privacy Notice

Mozilla Foundation Security Advisory 2009-19

Same-origin violations in XMLHttpRequest and XPCNativeWrapper.toString

Announced
April 21, 2009
Reporter
moz_bug_r_a4
Impact
High
Products
Firefox
Fixed in
  • Firefox 3.0.9

Description

Mozilla security researcher moz_bug_r_a4 reported that it is possible to create a document whose URI does not match the document's principal using XMLHttpRequest. This type of mismatch leads to incorrect results in principal-based security checks. An attacker could use this vulnerability to execute arbitrary JavaScript within the context of another site.

moz_bug_r_a4 separately reported that XPCNativeWrapper.toString's __proto__ comes from the wrong scope which results in calls to that function being executed in the wrong context in certain circumstances. An attacker could use this vulnerability to run arbitrary code within the context of a different site. Alternatively, if chrome were to call content.toString.call(), then attacker-defined functions could be run with chrome privileges.

Thunderbird shares the browser engine with Firefox and could be vulnerable if JavaScript were to be enabled in mail. This is not the default setting and we strongly discourage users from running JavaScript in mail.

References