Download Firefox

Firefox is no longer supported on Windows 8.1 and below.

Please download Firefox ESR (Extended Support Release) to use Firefox.

Firefox is no longer supported on macOS 10.14 and below.

Please download Firefox ESR (Extended Support Release) to use Firefox.

Firefox Privacy Notice

Mozilla Foundation Security Advisory 2015-69

Privilege escalation through internal workers

Announced
July 2, 2015
Reporter
Jonas Jenwald
Impact
High
Products
Firefox, Firefox ESR, Firefox OS
Fixed in
  • Firefox 39
  • Firefox ESR 31.8
  • Firefox ESR 38.1
  • Firefox OS 2.2

Description

Mozilla community member Jonas Jenwald reported broken behavior in Mozilla's PDF.js PDF file viewer which led to the discovery that internal Workers were incorrectly executed with high privilege. If this flaw were combined with a separate vulnerability allowing for same-origin policy violation, it could be used to run arbitrary code.

References