Mozilla Foundation Security Advisory 2010-10
XSS via plugins and unprotected Location object
- Announced
- March 23, 2010
- Reporter
- Blake Kaplan
- Impact
- High
- Products
- Firefox
- Fixed in
-
- Firefox 3.6.2
Description
Mozilla developer Blake Kaplan reported that the
window.location object was made a normal overridable JavaScript object
in the Firefox 3.6 browser engine (Gecko 1.9.2) because new mechanisms
were developed to enforce the same-origin policy between windows and frames.
This object is unfortunately also used by some plugins to determine the page
origin used for access restrictions. A malicious page could override this
object to fool a plugin into granting access to data on another site or the
local file system. The behavior of older Firefox versions has been restored.
This flaw does not affect earlier versions of Firefox, or other programs such as Thunderbird or SeaMonkey built on older versions of the browser engine.