Scripts on marquee tag can execute in sandboxed iframes

Scripts on marquee tag can execute in sandboxed iframes

Announced

August 2, 2016

Reporter

Nikita Arykov

Impact

Moderate

Products

Firefox, Firefox ESR

Fixed in

• Firefox 48
• Firefox ESR 45.3

Description

Security researcher Nikita Arykov reported that JavaScript event handler attributes on a <marquee> tag will execute inside a sandboxed iframe that does not have the allow-scripts flag set. This could result in a cross-site scripting (XSS) vulnerability in a site that depends on the iframe sandbox for sanitization and does no other content filtering.

References

• XSS out of iframe sandbox, iframe disabled javascript. marquee (CVE-2016-5262)