Ben Kelly

The issue is related to service workers using redirection to avoid the tainting of cross-origin resources, allowing a malicious site to read responses that are supposed to be opaque. This can enable a remote attacker to gain unauthorized access to protected information.

The issue is related to mixed content blocking in Firefox, where insecure HTTP sub-resources in a secure HTTPS document were not correctly blocked, especially for resources that redirect from HTTPS to HTTP. This allowed content, such as scripts, to be loaded on a page when it should have been blocked. The vulnerability can be exploited to conduct cross-site scripting attacks.

Memory safety bugs were reported, showing evidence of memory corruption. It is presumed that with enough effort, some of these bugs could be exploited to run arbitrary code.