You are here: Security Center > Mozilla Foundation Security Advisories > MFSA 2010-59
Mozilla Foundation Security Advisory 2010-59
Title: SJOW creates scope chains ending in outer object
Impact: Critical
Announced: September 7, 2010
Reporter: Blake Kaplan
Products: Firefox, Thunderbird
Fixed in: Firefox 3.6.9
Thunderbird 3.1.3
Description
Mozilla developer Blake Kaplan reported that the
wrapper class XPCSafeJSObjectWrapper
(SJOW), a security
wrapper that allows content-defined objects to be safely accessed by
privileged code, creates scope chains ending in outer objects. Users
of SJOWs which expect the scope chain to end on an inner object may be
handed a chrome privileged object which could be leveraged to run
arbitrary JavaScript with chrome privileges.
Michal Zalewski's recent contributions helped to identify this architectural weakness.