Missing delay following user click events in protocol handler dialog

Related Vulnerabilities: CVE-2016-1937  

Mozilla Foundation Security Advisory 2016-06

Missing delay following user click events in protocol handler dialog

Announced
January 26, 2016
Reporter
window
Impact
Moderate
Products
Firefox
Fixed in
  • Firefox 44

Description

Security researcher window reported an issue where the protocol handler dialog appears, double click events are treated as two single click events. This was caused by the lack of a delay following the initial focus in the file download dialog. This could cause a second dialog to be sent the second click, leading to unintentional user initiated actions, such as the running of downloaded software from a maliciously positioned prompt.

References