On Fri, 23 Feb 2007, Michal Zalewski wrote: > Firefox isn't outright vulnerable to this problem, but judging from its > behavior, it is likely to be susceptible to a variant of this bug And indeed, susceptible it is. On the surface, the problem is even more serious: the unloaded page can run Javascript in the context of a newly loaded one. Fortunately, at the time this is possible, 'document' and 'window' DOM hierarchies are not accessible - but then, 'location' is. With a bit of clever trickery, we can mount the following attack: http://lcamtuf.coredump.cx/ietrap/ff/ As shown there, the problem is less serious than MSIE7 full-scale Matrix-esque entrapment, but nevertheless - the bug is a cool one. And I have a gut feeling this Javascript page jumping can be turned into something nasty. Bugzilla: https://bugzilla.mozilla.org/show_bug.cgi?id=371360 /mz
