Tjr

A security issue exists where a sandboxed iframe with the `allow-top-navigation-by-user-activation` attribute can still process redirect headers to external protocols, potentially prompting the user.

Name of the Vulnerable Software and Affected Versions: Firefox versions prior to 87 Description: The issue allows an attacker to enable the Devtools remote debugging feature unnoticed by the user, potentially by altering specific about:config values, such as those modified by malware running on the user's computer. This could enable a remote attacker, who can make a direct network connection to the victim, to monitor the user's browsing activity and plaintext network traffic. A visual cue has been introduced for Devtools when it has an open network socket to address this issue. Recommendations: For Firefox versions prior to 87, update to version 87 or later to resolve the issue. As a temporary workaround, consider disabling the Devtools remote debugging feature until the update can be applied. Restrict access to the about:config values to minimize the risk of exploitation.

The issue is related to the MCallGetProperty opcode being emitted with unmet assumptions, resulting in an exploitable use-after-free condition. This can lead to accessing already freed memory, which is suitable for creating a working exploit. The problem is associated with the incorrect usage of the MCallGetProperty operation code.

The issue is related to a type confusion vulnerability in the IonMonkey JIT compiler, which could allow a remote attacker to gain access to confidential data, compromise data integrity, and cause a denial of service using a specially crafted web page. There have been targeted attacks in the wild abusing this flaw. The vulnerability can be exploited by tricking users into visiting a malicious site, potentially allowing remote attackers to take complete control over computers.