Mozilla Foundation Security Advisory 2009-69

Location bar spoofing vulnerabilities

December 15, 2009
Jonathan Morgan, Jordi Chancel
Firefox, SeaMonkey
Fixed in
  • Firefox 3.0.16
  • Firefox 3.5.6
  • SeaMonkey 2.0.1


Security researcher Jonathan Morgan reported that when a page loaded over an insecure protocol, such as http: or file:, sets its document.location to a https: URL which responds with a 204 status and empty response body, the insecure page will receive SSL indicators near the location bar, but will not have its page content modified in any way. This could lead to a user believing they were on a secure page when in fact they were not.

Security researcher Jordi Chancel reported an issue similar to one fixed in mfsa2009-44 in which a web page can set document.location to a URL that can't be displayed properly and then inject content into the resulting blank page. An attacker could use this vulnerability to place a legitimate-looking but invalid URL in the location bar and inject HTML and JavaScript into the body of the page, resulting in a spoofing attack.