Firefox Flaw: How Hackers Can Bypass Tracking Protection and CSP to Achieve XSS
Firefox’s Enhanced Tracking Protection may leave a shim in place of blocked scripts, but beware: a clever attacker might bypass strict-dynamic CSP using a DOM Clobbering attack, turning your secure site into an XSS playground.
Hot Take:
Firefox shims in to save the day—or does it? It looks like Mozilla’s browser might need more than a band-aid to patch up its Enhanced Tracking Protection. Buckle up, folks, because this ride through the world of web security is about to get bumpy!
Key Points:
- Firefox’s Enhanced Tracking Protection includes web-compatibility shims.
- These shims can be exploited via a DOM Clobbering attack, leading to XSS vulnerabilities.
- Affected sites use Content Security Policy in “strict-dynamic” mode.
- Web extensions with minimal permissions can create a StreamFilter to modify response bodies.
- PK11_Encrypt() in NSS poses a low-risk plaintext exposure on Intel Sandy Bridge processors.
Already a member? Log in here