Christoph Kerschbaumer

The issue is related to memory safety bugs, including evidence of memory corruption, which could potentially be exploited to run arbitrary code with sufficient effort. It is also associated with a boundary error when processing HTML content, allowing a remote attacker to execute arbitrary code and cause memory damage.

The issue arises from the nsCSPHostSrc::permits function in Mozilla Firefox, which does not implement Content Security Policy Level 2 exceptions for certain URL schemes during wildcard source-expression matching. This could make it easier for remote attackers to conduct cross-site scripting (XSS) attacks by leveraging unexpected policy-enforcement behavior. The vulnerability might allow a remote attacker to inject arbitrary HTML code.