Mozilla

Mozilla Foundation Security Advisory 2010-42

Cross-origin data disclosure via Web Workers and importScripts

Announced
July 20, 2010
Reporter
Yosuke Hasegawa
Impact
High
Products
Firefox, SeaMonkey, Thunderbird
Fixed in
  • Firefox 3.5.11
  • Firefox 3.6.7
  • SeaMonkey 2.0.6
  • Thunderbird 3.0.6
  • Thunderbird 3.1.1

Description

Security researcher Yosuke Hasegawa reported that the Web Worker method importScripts can read and parse resources from other domains even when the content is not valid JavaScript. This is a violation of the same-origin policy and could be used by an attacker to steal information from other sites.

References