Firefox: onUnload tailgating (MSIE7 entrapment bug variant) Feb 23 2007 12:49PM
Michal Zalewski (lcamtuf dione ids pl)
On Fri, 23 Feb 2007, Michal Zalewski wrote:

> Firefox isn't outright vulnerable to this problem, but judging from its
> behavior, it is likely to be susceptible to a variant of this bug

And indeed, susceptible it is. On the surface, the problem is even more
serious: the unloaded page can run Javascript in the context of a newly
loaded one. Fortunately, at the time this is possible, 'document' and
'window' DOM hierarchies are not accessible - but then, 'location' is.
With a bit of clever trickery, we can mount the following attack:

As shown there, the problem is less serious than MSIE7 full-scale
Matrix-esque entrapment, but nevertheless - the bug is a cool one. And I
have a gut feeling this Javascript page jumping can be turned into
something nasty.



[ reply ]


Privacy Statement
Copyright 2010, SecurityFocus