Yossi Oren

**Name of the Vulnerable Software and Affected Versions** Mozilla Firefox versions prior to 41.0 **Description** The issue is related to the lack of protection for service data in the browser, which can be exploited by a remote attacker using specially crafted JavaScript code. This code exploits errors in the configuration of access to High Resolution Time API components, potentially allowing access to protected information. The vulnerability can be used to track last-level cache access, consequently obtaining sensitive information through crafted JavaScript code that makes performance.now calls. **Recommendations** For versions prior to 41.0, update to version 41.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the High Resolution Time API to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Apple iOS versions prior to 9 **Description** The issue is related to the WebKit component in Apple iOS, which does not properly restrict access to sensitive information. This allows remote attackers to obtain sensitive information about the browser history, mouse movement, or network traffic via crafted JavaScript code. The estimated number of potentially affected devices worldwide is not specified. There is no information about real-world incidents where this issue was exploited. **Recommendations** For Apple iOS versions prior to 9, update to a version 9 or later to resolve the issue. As a temporary workaround, consider restricting the use of JavaScript code from untrusted sources until a patch is available. Avoid using the Performance API times in crafted JavaScript code to minimize the risk of exploitation.