Mozilla Foundation Security Advisory 2010-46
Cross-domain data theft using CSS
- Announced
- July 20, 2010
- Reporter
- Chris Evans
- Impact
- Moderate
- Products
- Firefox, SeaMonkey, Thunderbird
- Fixed in
-
- Firefox 3.5.11
- Firefox 3.6.7
- SeaMonkey 2.0.6
- Thunderbird 3.0.6
- Thunderbird 3.1.1
Description
Google security researcher Chris Evans reported
that data can be read across domains by injecting bogus CSS selectors
into a target site and then retrieving the data using JavaScript APIs.
If an attacker can inject opening and closing portions of a CSS
selector into points A and B of a target page, then the region between
the two injection points becomes readable to JavaScript through, for
example, the getComputedStyle() API.