Mozilla

mozilla

Mozilla Foundation Security Advisory 2010-46

Cross-domain data theft using CSS

Announced
July 20, 2010
Reporter
Chris Evans
Impact
Moderate
Products
Firefox, SeaMonkey, Thunderbird
Fixed in
  • Firefox 3.5.11
  • Firefox 3.6.7
  • SeaMonkey 2.0.6
  • Thunderbird 3.0.6
  • Thunderbird 3.1.1

Description

Google security researcher Chris Evans reported that data can be read across domains by injecting bogus CSS selectors into a target site and then retrieving the data using JavaScript APIs. If an attacker can inject opening and closing portions of a CSS selector into points A and B of a target page, then the region between the two injection points becomes readable to JavaScript through, for example, the getComputedStyle() API.

References