CVE-2019-11716

Hasta que se acceda de forma explícita mediante un script, window.globalThis no es enumerable y, como resultado, no es visible para código tal y como Object.getOwnPropertyNames(window). Los sitios que implementan un sandbox que depende de la enumeración y la congelación del acceso al objeto de la ventana pueden pasarlo por alto, lo que permite que se eludan sus sandbox. Esta vulnerabilidad afecta a Firefox anterior a versión 68.

A sandbox escape was discovered in Firefox. If a user were tricked in to installing a malicious language pack, an attacker could exploit this to gain additional privileges. Multiple security issues were discovered in Firefox. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service, obtain sensitive information, bypass same origin restrictions, conduct cross-site scripting attacks, conduct cross-site request forgery attacks, spoof origin attributes, spoof the addressbar contents, bypass safebrowsing protections, or execute arbitrary code. Various other issues were also addressed.