Critical · published November 21, 2023
⚠️ Just a tiny tweak in your settings, and internal data could be peeking out! An attacker can exploit the `referrerpolicy` attribute in Firefox for iOS < 120 to snatch a security key like a thief snagging a forgotten wallet. 🔍 Think of it like a restaurant where the staff mistakenly lets anyone back into the kitchen just because they asked nicely for a 'tour'. Without strong policies in place, sensitive ingredients might end up in the wrong hands! If an attacker is successful, they could easily access internal pages or sensitive data, potentially leading to unauthorized actions or leaks that could compromise user safety. The implications could be severe for users relying on the app for secure browsing!
Think of it like a restaurant where the staff mistakenly lets anyone back into the kitchen just because they asked nicely for a 'tour'. Without strong policies in place, sensitive ingredients might end up in the wrong hands! This vulnerability allows attackers to ex-filtrate a security key through the `referrerpolicy` attribute in ReaderMode, leading to unauthorized access. It primarily affects Firefox for iOS versions below 120.
If an attacker is successful, they could easily access internal pages or sensitive data, potentially leading to unauthorized actions or leaks that could compromise user safety. The implications could be severe for users relying on the app for secure browsing! To safeguard against this, update Firefox for iOS to version 120 or higher immediately. Additionally, review and tighten referrer policies if applicable in any projects you manage! You've got this! With a quick update and a few policy tweaks, you'll keep your data safe and sound! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| mozilla/firefox_mobile | < 120.0 | 120.0 |