Scripted proxies can access inner window

Scripted proxies can access inner window

Announced

September 22, 2015

Reporter

André Bargull

Impact

Moderate

Products

Firefox, Firefox OS, SeaMonkey

Fixed in

• Firefox 41
• Firefox OS 2.5
• SeaMonkey 2.38

Description

Security researcher André Bargull reported that when a web page creates a scripted proxy for the window with a handler defined a certain way, a reference to the inner window will be passed, rather than that of the outer window in violation of the specification.

References

• Receiver passed to proxy get hook is not outerized when proxy is on the window's proto chain (CVE-2015-4502)