Mozilla

Mozilla Foundation Security Advisory 2015-136

Same-origin policy violation using performance.getEntries and history navigation

Announced
December 15, 2015
Reporter
cgvwzq
Impact
High
Products
Firefox, Firefox ESR
Fixed in
  • Firefox 43
  • Firefox ESR 38.7

Description

Security researcher cgvwzq reported that it is possible to read cross-origin URLs following a redirect if performance.getEntries() is used along with an iframe to host a page. Navigating back in history through script, content is pulled from the browser cache for the redirected location instead of going to the original location. This is a same-origin policy violation and could allow for data theft.

This issue affects other browsers as well and is not limited to Mozilla products.

References