icon_firefox[CVE-2016-1943] Location Bar Spoofing Risk – scrollto leads to that the location bar is hidden


Location Bar Spoofing Risk – scrollto leads to that the location bar is hidden


Announced: January 26, 2016
Reporter: Jordi Chancel
Impact: High
Products: Firefox
Fixed in: Firefox 44


Description

Security researcher Jordi Chancel reported two issues involving addressbar spoofing.

The first of these is a « high » rated security issue on on Firefox for Android involving the scrollTo() method to scroll a page. In this attack, scrollTo() is used to scroll the addressbar out of view while replacing it with a fake addressbar created by the attacker when a new tab is opened.


Vulnerability demonstration (video):


Comments are closed.