Mozilla

Mozilla

Mozilla Foundation Security Advisory 2014-10

Firefox default start page UI content invokable by script

Announced
February 4, 2014
Reporter
Yazan Tommalieh
Impact
Low
Products
Firefox
Fixed in
  • Firefox 27

Description

Yazan Tommalieh discovered a flaw that once users have viewed the default Firefox start page (about:home), subsequent pages they navigate to in that same tab could use script to activate the buttons that were on the about:home page. Most of these simply open Firefox dialogs such as Settings or History, which might alarm users. In some cases a malicious page could trigger session restore and cause data loss if the current tabs are replaced by a previously stored set.

References