Mozilla Foundation Security Advisory 2014-10
Firefox default start page UI content invokable by script
- Announced
- February 4, 2014
- Reporter
- Yazan Tommalieh
- Impact
- Low
- Products
- Firefox
- Fixed in
-
- Firefox 27
Description
Yazan Tommalieh discovered a flaw that once users have viewed the default Firefox start page (about:home), subsequent pages they navigate to in that same tab could use script to activate the buttons that were on the about:home page. Most of these simply open Firefox dialogs such as Settings or History, which might alarm users. In some cases a malicious page could trigger session restore and cause data loss if the current tabs are replaced by a previously stored set.