9.3 High
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:M/Au:N/C:C/I:C/A:C
0.015 Low
EPSS
Percentile
86.5%
Security researcher Mariusz Mlynski reported that when InstallTrigger fails, it throws an error wrapped in a Chrome Object Wrapper (COW) that fails to specify exposed properties. These can then be added to the resulting object by an attacker, allowing access to chrome privileged functions through script.
CPE | Name | Operator | Version |
---|---|---|---|
firefox | lt | 16 | |
firefox esr | lt | 10.0.8 | |
seamonkey | lt | 2.13 | |
thunderbird | lt | 16 | |
thunderbird esr | lt | 10.0.8 |