On pages containing an iframe, the "data:" protocol can be used to create a modal dialog through Javascript that will have an arbitrary domains as the dialog's location, spoofing of the origin of the modal dialog from the user view. Note: This attack only affects installations with e10 multiprocess turned off. Installations with e10s turned on do not support the modal dialog functionality. This vulnerability affects Firefox < 56.
Metrics
Affected Vendors & Products
References
History
No history.
MITRE
Status: PUBLISHED
Assigner: mozilla
Published: 2018-06-11T21:00:00
Updated: 2024-08-05T16:12:28.513Z
Reserved: 2017-04-12T00:00:00
Link: CVE-2017-7815
Vulnrichment
No data.
NVD
Status : Modified
Published: 2018-06-11T21:29:10.607
Modified: 2024-11-21T03:32:43.343
Link: CVE-2017-7815
Redhat
No data.