← back
CVE-2017-7834

CVE-2017-7834

EPSS 1.5%
A "data:" URL loaded in a new tab did not inherit the Content Security Policy (CSP) of the original page, allowing for bypasses of the policy including the execution of JavaScript. In prior versions when "data:" documents also inherited the context of the original page this would allow for potential cross-site scripting (XSS) attacks. This vulnerability affects Firefox < 57.
Affected products
Mozilla · Firefox

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →
References
https://bugzilla.mozilla.org/show_bug.cgi?id=1358009https://www.mozilla.org/security/advisories/mfsa2017-24/http://www.securityfocus.com/bid/101832http://www.securitytracker.com/id/1039803