Download Firefox

Firefox is no longer supported on Windows 8.1 and below.

Please download Firefox ESR (Extended Support Release) to use Firefox.

Firefox is no longer supported on macOS 10.14 and below.

Please download Firefox ESR (Extended Support Release) to use Firefox.

Firefox Privacy Notice

Mozilla Foundation Security Advisory 2015-114

Information disclosure via the High Resolution Time API

Announced
September 22, 2015
Reporter
Yossef Oren et al, Amit Klein
Impact
Moderate
Products
Firefox, Firefox OS, SeaMonkey
Fixed in
  • Firefox 41
  • Firefox OS 2.5
  • SeaMonkey 2.38

Description

Security researchers Yossef Oren, Vasileios P. Kemerlis, Simha Sethumadhavan, Angelos D. Keromytis of Columbia University's Network Security Lab reported a method of using the High Resolution Time API for side channel attacks. This attack uses JavaScript loaded through a hostile web page to track access to the last-level cache over a period of time as a user engages in other browser activity. This attack takes advantage of the performance.now() API's use of single nanosecond resolution for timing.

Security researcher Amit Klein independently reported use of the performance.now() API on Windows systems to extract the Windows counter frequency as an avenue for side channel attacks.

Both of these flaws allow for the disclosure of private information, user fingerprinting, and data leakage. They have been addressed by reducing the resolution of the performance.now() API to 5 microseconds to remove the precision in resolution available to attackers.

The Windows counter frequency issue does not affect Linux or OS X systems.

References