Matt Wobensmith

The issue exists due to the browser's failure to properly enforce web page structure protection, allowing a remote attacker to conduct cross-site scripting (XSS) attacks using a specially crafted applet. This can be achieved by ignoring Content Security Policy (CSP) directives for cross-domain Java applets.

The issue concerns the getUserMedia permission implementation, which incorrectly references the URL of a top-level document instead of the URL of a specific page. This makes it easier for remote attackers to trick users into permitting camera or microphone access via a crafted web site that uses IFRAME elements.