Regular expressions used to filter out forbidden properties and values from style directives in calls to <code>console.log</code> weren't accounting for external URLs. Data could then be potentially exfiltrated from the browser. This vulnerability affects Firefox < 109, Thunderbird < 102.7, and Firefox ESR < 102.7.
The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.
| Link | Tags |
|---|---|
| https://www.mozilla.org/security/advisories/mfsa2023-02/ | vendor advisory |
| https://www.mozilla.org/security/advisories/mfsa2023-01/ | vendor advisory |
| https://www.mozilla.org/security/advisories/mfsa2023-03/ | vendor advisory |
| https://bugzilla.mozilla.org/show_bug.cgi?id=1800832 | vendor advisory issue tracking permissions required |