JavaScript in the "about:webrtc" page is not sanitized properly being assigned to "innerHTML". Data on this page is supplied by WebRTC usage and is not under third-party control, making this difficult to exploit, but the vulnerability could possibly be used for a cross-site scripting (XSS) attack. This vulnerability affects Firefox < 55.
No se sanea correctamente el JavaScript en la página "about:webrtc" antes de asignarse a "innerHTML". Los datos en esta página son proporcionados por el uso de WebRTC y no está bajo control de terceros, lo que dificulta su explotación, pero la vulnerabilidad podría emplearse para realizar ataques de Cross-Site Scripting (XSS). La vulnerabilidad afecta a Firefox en versiones anteriores a la 55.
USN-3391-1 fixed vulnerabilities in Firefox. The update introduced a performance regression with WebExtensions. This update fixes the problem. Multiple security issues were discovered in Firefox. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to conduct cross-site scripting attacks, bypass sandbox restrictions, obtain sensitive information, spoof the origin of modal alerts, bypass same origin restrictions, read uninitialized memory, cause a denial of service via program crash or hang, or execute arbitrary code. Various other issues were also addressed.
