Information disclosure of disabled plugins through CSS pseudo-classes

Information disclosure of disabled plugins through CSS pseudo-classes

Announced

June 7, 2016

Reporter

John Schoenick

Impact

Moderate

Products

Firefox

Fixed in

• Firefox 47

Description

Mozilla developer John Schoenick reported that CSS pseudo-classes can be used by web content to leak information on plugins that are installed but disabled. This can be used for information disclosure through a fingerprinting attack that lists all of the plugins installed by a user on a system, even when they are disabled.

References

• -moz-handler css pseudo-classes leak plugin state to content (CVE-2016-2832)