Jordi Chancel

Name of the Vulnerable Software and Affected Versions: Firefox versions prior to 88 Firefox ESR versions prior to 78.10 Thunderbird versions prior to 78.10 Description: The issue is related to errors in saving permissions, which could allow a remote attacker to incorrectly assign a security certificate to an HTTP page, potentially spoofing the HTTPS browser padlock. This could occur through complicated navigations with new windows, where an HTTP page could inherit a secure lock icon from an HTTPS page. Recommendations: For Firefox versions prior to 88, update to version 88 or later to resolve the issue. For Firefox ESR versions prior to 78.10, update to version 78.10 or later to resolve the issue. For Thunderbird versions prior to 78.10, update to version 78.10 or later to resolve the issue.

The issue allows the displayed address bar URL to be spoofed, potentially leading to user confusion. This is achieved by using a javascript: URI in combination with JavaScript to insert text before the loaded domain name and scrolling the loaded domain out of view to the right.

The issue is related to a lack of protection for internal data in the Firefox web browser. If a text string that is a filename in the operating system's native format is dragged and dropped onto the address bar, the specified local file will be opened, contrary to policy. This could potentially allow a remote attacker to gain unauthorized access to protected information.

A mechanism in Firefox for Android allows a malicious site to display a spoofed addressbar when entering fullscreen mode after loading a new tab through JavaScript events. This enables the malicious site to show the location of an arbitrary website instead of the one loaded. Desktop Firefox is unaffected.

Name of the Vulnerable Software and Affected Versions: Firefox versions prior to 53 Description: A spoofing issue exists where malicious sites can display a fake address bar on a page when the actual location bar is scrolled out of view, but only if an HTML editable page element is user-selected. This issue specifically affects Firefox for Android, with other operating systems not being affected. Recommendations: For versions prior to 53, update to version 53 or later to resolve the issue.

The issue is related to the implementation of the Content Security Policy (CSP) in Mozilla Firefox, specifically when loading "data:" URLs. This could allow a remote attacker to conduct cross-site scripting (XSS) attacks by bypassing the CSP, potentially executing JavaScript.

Name of the Vulnerable Software and Affected Versions: Firefox for Android versions prior to 51 Description: The issue is a location bar spoofing attack that occurs when a series of JavaScript events are combined with fullscreen mode, causing the location bar of a loaded page to be shown over the content of another tab. This problem is specific to Firefox for Android and does not affect other operating systems. Recommendations: For Firefox for Android versions prior to 51, update to version 51 or later to resolve the issue.

Name of the Vulnerable Software and Affected Versions: Firefox for Android versions prior to 51 Description: A spoofing issue exists where malicious sites can display a fake location bar on a subsequently loaded page when the existing location bar on the new page is scrolled out of view, if navigations between pages can be timed correctly. This issue is specific to Firefox for Android and does not affect other operating systems. Recommendations: For Firefox for Android versions prior to 51, update to version 51 or later to resolve the issue.

A mechanism exists where the disruption of loading a new web page can cause the previous page's favicon and SSL indicator to not be reset when the new page is loaded. This issue only affects Firefox for Android, with desktop Firefox being unaffected.

The issue allows remote attackers to spoof the address bar. This can be achieved via a SELECT element with a persistent menu.

The issue is related to a mechanism that allows spoofing the address bar through user interaction on the address bar and the `onblur` event. This could be used by a script to affect text display, making the loaded site appear different from the one actually loaded within the address bar. The vulnerability is associated with insufficient input validation, which may allow a remote attacker to conduct spoofing attacks.

The issue is related to an incomplete restriction of IFRAME Resource Timing API times, allowing remote attackers to bypass the Same Origin Policy and obtain sensitive information. This can be achieved through crafted JavaScript code that leverages `history.back` and `performance.getEntries` calls after restoring a browser session.

The issue allows remote attackers to conduct clickjacking attacks via a crafted web site. This is due to the file-download dialog enabling a certain button too quickly, triggering a single-click action in a situation where a double-click action was intended.

The issue allows remote attackers to spoof the address bar. This is achieved via the `scrollTo` method.

The issue allows remote attackers to spoof a trailing substring in the address bar by leveraging a user's paste of a (1) wyciwyg: URI or (2) resource: URI. This can be achieved when a user assists the attack, potentially leading to misleading information being displayed in the address bar.

The issue is related to errors in security settings, allowing remote attackers to spoof the address bar via crafted JavaScript code. This can occur when the browser exits fullscreen mode and fails to restore the address bar properly.

The issue is related to a lack of protection for service data, which can be exploited by a remote attacker using a specially crafted HTML document. This can allow the attacker to bypass access control rules and compromise data privacy. The exploitation involves bypassing the Same Origin Policy, potentially leading to unauthorized actions such as triggering a download or reading cached profile data via a file: URL in a saved HTML document.

The issue is related to errors in security settings, allowing a remote attacker to modify address-bar attributes after a user inputs a URL. This can be achieved by leveraging a lack of navigation after a paste of a URL with a nonstandard scheme, potentially allowing the spoofing of attributes such as SSL.

The issue allows remote attackers to conduct clickjacking attacks via a Flash object in conjunction with DIV elements associated with layered presentation, and crafted JavaScript code that interacts with an IMG element. This occurs because the software does not ensure that the cursor is visible.

The issue allows remote attackers to spoof the address bar or conduct clickjacking attacks via vectors that trigger navigation off of a page containing the SELECT element implementation. This is due to the improper restriction of the nature or placement of HTML within a dropdown menu.