Mozilla Foundation Security Advisory 2013-06
Touch events are shared across iframes
- Announced
- January 8, 2013
- Reporter
- Wesley Johnston
- Impact
- Moderate
- Products
- Firefox, SeaMonkey
- Fixed in
-
- Firefox 18
- SeaMonkey 2.15
Description
Mozilla developer Wesley Johnston reported that when there are two or more iframes on the same HTML page, an iframe is able to see the touch events and their targets that occur within the other iframes on the page. If the iframes are from the same origin, they can also access the properties and methods of the targets of other iframes but same-origin policy (SOP) restricts access across domains. This allows for information leakage and possibilities for cross-site scripting (XSS) if another vulnerability can be used to get around SOP restrictions.
These touch events are only currently used in Firefox for Android and other products should not be exposed these this vulnerability.