| Package | Affected versions | Patched versions |
|---|---|---|
| firefox | ≤ 45.0.2 |
The WebExtension sandbox feature in browser/components/extensions/ext-tabs.js in Mozilla Firefox before 46.0 does not properly restrict principal inheritance during chrome.tabs.create and chrome.tabs.update API calls, which allows remote attackers to conduct Universal XSS (UXSS) attacks via a crafted extension that accesses a (1) javascript: or (2) data: URL.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free