Muneaki Nishimura

Firefox for iOS directly interpolated the page HTML language attribute into translation JavaScript. This allows attacker-controlled markup to execute code within the privileged content world of the browser and bypass the Content Security Policy (CSP), a security layer that helps detect and mitigate certain types of attacks, including cross-site scripting and data injection.

Pages with malicious titles could potentially allow saved PDF content to overwrite PDF files or bundled content within the application sandbox.

Firefox for iOS preserved cookies set on the initial PDF request across cross-origin HTTP redirects in TemporaryDocument. This behavior allows a malicious site to inject arbitrary cookies into requests directed to an unrelated target domain.

Firefox for iOS used partial domain matching when attaching cookies to PDF requests. This behavior allows a malicious site hosted on a suffix domain to receive cookies belonging to the target site, leading to cookie leakage.

Reader View fails to properly escape HTML tags within JSON-LD metadata. This allows a malicious page to inject markup that alters Reader View behavior and leaks sensitive URL parameters. Such leaked parameters could be utilized to access internal pages, which may lead to arbitrary JavaScript execution within an internal origin.

Reader View in Firefox for iOS replaced page content in its HTML template before substituting other internal placeholders. A malicious page could include a placeholder string that was subsequently replaced with JSON-LD (JavaScript Object Notation for Linked Data, a format for describing structured data) data, which could lead to arbitrary JavaScript execution.

Reader mode was hosted on an unauthenticated local web server. This allows another application on the same device to request arbitrary URLs and receive the response rendered with the signed-in user's cookies.

A flaw existed in how Firefox for iOS handled cookie storage for non-HTML temporary documents. This resulted in incorrect sharing of cookie storage between non-HTML temporary documents and normal browsing content. Consequently, information from private tabs could potentially leave Incognito mode, even after all tabs were closed.

Name of the Vulnerable Software and Affected Versions: Focus for iOS versions prior to 14.2 Description: Dragging JavaScript links to the URL bar in Focus for iOS could be utilized to run malicious scripts, potentially resulting in cross-site scripting (XSS) attacks. Recommendations: Update Focus for iOS to version 14.2 or later.

The issue is related to errors in the representation of information by the user interface. It may allow a remote attacker to conduct spoofing attacks using the ` cpLocation` attribute, potentially misleading users about the actual website address. A malicious website could attempt to display a fake location URL bar.

The issue is related to insufficient input validation when dragging URL addresses into the address bar, allowing a remote attacker to bypass security restrictions and load arbitrary pages. This can be achieved by dragging Javascript URLs to the address bar, which could cause them to be loaded and bypass security protections.

The issue is related to incorrect security UI in Google Chrome, allowing a remote attacker to perform UI spoofing via a crafted HTML page. This can be achieved by exploiting the incorrect limitation of visualized UI layers. The estimated number of potentially affected devices worldwide is not provided. There is no information about real-world incidents where this issue was exploited.

An attacker could execute unauthorized scripts on top origin sites using a JavaScript URI when opening an external URL with a custom Firefox scheme.

An issue allows an attacker to execute JavaScript from an opened bookmarked page when using an AMP url with a canonical element.

The issue is related to incorrect security UI in Payments, allowing a remote attacker to potentially spoof security UI via a crafted HTML page. This could enable the attacker to bypass security restrictions. The severity of this issue is classified as Medium.

The issue is related to the Reader Mode in Firefox for iOS, where the browser fails to neutralize HTML tags, allowing an attacker to perform HTML template injection. This could enable a remote attacker to gain unauthorized access to protected information and conduct cross-site scripting attacks. The estimated number of potentially affected devices is not specified.

The issue is related to insufficient access control due to key filtering via the `referrerpolicy` attribute in Reader Mode. This could allow a remote attacker to elevate their privileges by ex-filtrating a security key.

The issue is related to the HTTPS-only mode in Firefox, where an attacker could trick a user into granting an HTTPS-only exception by getting them to participate in a clicking game, if the user had enabled HTTPS-only mode and was loading an insecure HTTP page. This could allow a remote attacker to conduct a clickjacking attack by exploiting errors in the user interface's information presentation.

The issue is related to the handling of HTTP requests, which could allow a remote attacker to bypass existing security restrictions and disclose protected information using the HTTP referer header. This is due to the potential leak of a secret UUID key through the Referrer header.

The issue is related to a lack of protection against SQL query structure exploitation. This could allow a remote attacker to send specially crafted data to the application, potentially executing arbitrary SQL commands. The search term could be specified externally to trigger SQL injection.