Mozilla

mozilla

Mozilla Foundation Security Advisory 2014-23

Content Security Policy for data: documents not preserved by session restore

Announced
March 18, 2014
Reporter
Nicolas Golubovic
Impact
Low
Products
Firefox, SeaMonkey
Fixed in
  • Firefox 28
  • SeaMonkey 2.25

Description

Security researcher Nicolas Golubovic reported that the Content Security Policy (CSP) of data: documents was not saved as part of session restore. If an attacker convinced a victim to open a document from a data: URL injected onto a page, this can lead to a Cross-Site Scripting (XSS) attack. The target page may have a strict CSP that protects against this XSS attack, but if the attacker induces a browser crash with another bug, an XSS attack would occur during session restoration, bypassing the CSP on the site.

References