Mozilla

Mozilla Foundation Security Advisory 2016-22

Service Worker Manager out-of-bounds read in Service Worker Manager

Announced
March 8, 2016
Reporter
Looben Yang
Impact
Critical
Products
Firefox
Fixed in
  • Firefox 45

Description

Security researcher Looben Yang reported a mechanism where the Clients API in Service Workers can be used to trigger an out-of-bounds read in ServiceWorkerManager. This results in a potentially exploitable crash.

References