Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2020-12391

Documents formed using data: URLs in an OBJECT element failed to inherit the CSP of the creating context. This allowed the execution of scripts that should have been blocked, albei

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
mozilla

Description

Documents formed using data: URLs in an OBJECT element failed to inherit the CSP of the creating context. This allowed the execution of scripts that should have been blocked, albeit with a unique opaque origin. This vulnerability affects Firefox < 76.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Mozilla Firefox

  • unspecified to < 76affected

References