Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2017-7834

A "data:" URL loaded in a new tab did not inherit the Content Security Policy (CSP) of the original page, allowing for bypasses of the policy including the execution of JavaScript.

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
mozilla

Description

A "data:" URL loaded in a new tab did not inherit the Content Security Policy (CSP) of the original page, allowing for bypasses of the policy including the execution of JavaScript. In prior versions when "data:" documents also inherited the context of the original page this would allow for potential cross-site scripting (XSS) attacks. This vulnerability affects Firefox < 57.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Mozilla Firefox

  • unspecified to < 57affected

References