Mozilla Foundation Security Advisory 2015-108
Scripted proxies can access inner window
- Announced
- September 22, 2015
- Reporter
- André Bargull
- Impact
- Moderate
- Products
- Firefox, Firefox OS, SeaMonkey
- Fixed in
-
- Firefox 41
- Firefox OS 2.5
- SeaMonkey 2.38
Description
Security researcher André Bargull reported that when a web page creates a scripted proxy for the window with a handler defined a certain way, a reference to the inner window will be passed, rather than that of the outer window in violation of the specification.