Mozilla Foundation Security Advisory 2015-149
Cross-site reading attack through data and view-source URIs
- Announced
- December 15, 2015
- Reporter
- Tsubasa Iinuma
- Impact
- Critical
- Products
- Firefox, Firefox ESR, Firefox OS, Thunderbird
- Fixed in
-
- Firefox 43
- Firefox ESR 38.5
- Firefox OS 2.5
- Thunderbird 38.5
Description
Security researcher Tsubasa Iinuma reported a mechanism to violate
same-origin policy to content using data: and view-source: URIs
to confuse protections and bypass restrictions. This resulted in the ability to read data from cross-site URLs and local files.
In general this flaw cannot be exploited through email in the Thunderbird product because scripting is disabled, but is potentially a risk in browser or browser-like contexts.