Service Worker Manager out-of-bounds read in Service Worker Manager

Service Worker Manager out-of-bounds read in Service Worker Manager

Announced

March 8, 2016

Reporter

Looben Yang

Impact

Critical

Products

Firefox

Fixed in

• Firefox 45

Description

Security researcher Looben Yang reported a mechanism where the Clients API in Service Workers can be used to trigger an out-of-bounds read in ServiceWorkerManager. This results in a potentially exploitable crash.

References

• Service Worker - Memory corruption in ServiceWorkerManager (CVE-2016-1959)