Mozilla Foundation Security Advisory 2015-148
Privilege escalation vulnerabilities in WebExtension APIs
- Announced
- December 15, 2015
- Reporter
- Kris Maglione
- Impact
- Critical
- Products
- Firefox
- Fixed in
-
- Firefox 43
Description
Mozilla developer Kris Maglione reported a mechanism where WebExtension APIs could be used to escalate privilege. This could allow arbitrary web content to execute code with the privileges of a particular WebExtension when using these API calls. Depending on the privileges of the extension used, this could result in personal information theft and cross-site scripting (XSS) attacks, including theft of browser cookies. This is mitigated by the requirement to have a WebExtension installed that is vulnerable to this issue.