Уязвимость раскрытия внутренних интерфейсов браузера в Firefox и Thunderbird через привилегированные обработчики событий
Описание
Внутренние интерфейсы браузера становились доступны веб-контенту при выполнении привилегированных обратных вызовов обработчиков событий (EventHandler) для соответствующих событий. Хотя веб-контент не мог использовать эти интерфейсы с повышенными привилегиями, их наличие могло указывать на использование определенных функций браузера, таких как открытие консоли инструментов разработчика (DevTools).
Затронутые версии ПО
- Firefox < 130
- Firefox ESR < 128.2
- Firefox ESR < 115.15
- Thunderbird < 128.2
- Thunderbird < 115.15
Тип уязвимости
Раскрытие информации (о состоянии браузера)
Ссылки
- Issue TrackingPermissions Required
- Vendor Advisory
- Vendor Advisory
- Vendor Advisory
Уязвимые конфигурации
Одно из
EPSS
8.8 High
CVSS3
Дефекты
Связанные уязвимости
Internal browser event interfaces were exposed to web content when privileged EventHandler listener callbacks ran for those events. Web content that tried to use those interfaces would not be able to use them with elevated privileges, but their presence would indicate certain browser features had been used, such as when a user opened the Dev Tools console. This vulnerability affects Firefox < 130, Firefox ESR < 128.2, Firefox ESR < 115.15, Thunderbird < 128.2, and Thunderbird < 115.15.
Internal browser event interfaces were exposed to web content when privileged EventHandler listener callbacks ran for those events. Web content that tried to use those interfaces would not be able to use them with elevated privileges, but their presence would indicate certain browser features had been used, such as when a user opened the Dev Tools console. This vulnerability affects Firefox < 130, Firefox ESR < 128.2, Firefox ESR < 115.15, Thunderbird < 128.2, and Thunderbird < 115.15.
Internal browser event interfaces were exposed to web content when pri ...
Internal browser event interfaces were exposed to web content when privileged EventHandler listener callbacks ran for those events. Web content that tried to use those interfaces would not be able to use them with elevated privileges, but their presence would indicate certain browser features had been used, such as when a user opened the Dev Tools console. This vulnerability affects Firefox < 130, Firefox ESR < 128.2, and Firefox ESR < 115.15.
Уязвимость внутренних интерфейсов событий браузеров Mozilla Firefox, Firefox ESR и почтового клиента Thunderbird, позволяющая нарушителю повысить свои привилегии
EPSS
8.8 High
CVSS3