PT-2016-1450

Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions prior to 45.0 Description The issue is related to an incomplete restriction of IFRAME Resource Timing API times, allowing remote attackers to bypass the Same Origin Policy and obtain sensitive information. This can be...

PT-2015-2883

Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions prior to 43.0 Description The issue is related to improper access restriction to the IFRAME Resource Timing API in the browser. This can be exploited by a remote attacker to bypass the existing access policy or obtain...

Same-origin policy violation using performance.getEntries and history navigation — Mozilla

Security researcher cgvwzq reported that it is possible to read cross-origin URLs following a redirect if performance.getEntries is used along with an iframe to host a page. Navigating back in history through script, content is pulled from the browser cache for the redirected location instead of...