Mozilla Foundation Security Advisory 2010-42
Cross-origin data disclosure via Web Workers and importScripts
- Announced
- July 20, 2010
- Reporter
- Yosuke Hasegawa
- Impact
- High
- Products
- Firefox, SeaMonkey, Thunderbird
- Fixed in
-
- Firefox 3.5.11
- Firefox 3.6.7
- SeaMonkey 2.0.6
- Thunderbird 3.0.6
- Thunderbird 3.1.1
Description
Security researcher Yosuke Hasegawa reported that
the Web Worker method importScripts can read and parse
resources from other domains even when the content is not valid
JavaScript. This is a violation of the same-origin policy and could
be used by an attacker to steal information from other sites.