CVE-2016-1967

Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions prior to 45.0

Description The issue is related to an incomplete restriction of IFRAME Resource Timing API times, allowing remote attackers to bypass the Same Origin Policy and obtain sensitive information. This can be achieved through crafted JavaScript code that leverages history.back and performance.getEntries calls after restoring a browser session.

Recommendations For versions prior to 45.0, update to version 45.0 or later to resolve the issue. As a temporary workaround, consider restricting the use of IFRAME elements and limiting access to the performance.getEntries function until a patch is applied. Avoid using the history.back function in conjunction with performance.getEntries calls after restoring a browser session to minimize the risk of exploitation.