Mozilla

Mozilla Foundation Security Advisory 2015-148

Privilege escalation vulnerabilities in WebExtension APIs

Announced
December 15, 2015
Reporter
Kris Maglione
Impact
Critical
Products
Firefox
Fixed in
  • Firefox 43

Description

Mozilla developer Kris Maglione reported a mechanism where WebExtension APIs could be used to escalate privilege. This could allow arbitrary web content to execute code with the privileges of a particular WebExtension when using these API calls. Depending on the privileges of the extension used, this could result in personal information theft and cross-site scripting (XSS) attacks, including theft of browser cookies. This is mitigated by the requirement to have a WebExtension installed that is vulnerable to this issue.

References