Security Severity Ratings/Client: Difference between revisions

Security Severity Ratings/Client (view source)

208 bytes removed , 24 June

142

edits

@@ Line 73: / Line 73: @@
 If there are mitigating circumstances that severely constrain the vulnerability, then the issue could be reduced by one or more levels of severity.
- - Any bug that requires a user to have an accessibility client installed or using assistive technology is capped at a sec-moderate
+- Any bug that requires DevTools to have been opened by the user is capped at a sec-moderate
- - Any bug that requires DevTools to have been opened by the user is capped at a sec-moderate
+- As mentioned above, Memory Safety issues caused by OOM conditions, unless precise triggering of the condition can be shown, are capped at sec-moderate
- - As mentioned above, Memory Safety issues caused by OOM conditions, unless precise triggering of the condition can be shown, are capped at sec-moderate
+- Similarly unreliable race conditions that crash the browser are also capped at sec-moderate; if the attacker can retry it will not be reduced
- - Similarly unreliable race conditions that crash the browser are also capped at sec-moderate; if the attacker can retry it will not be reduced
+- Requiring complex or unusual set of actions the user would have to take beyond normal browsing behaviors
- - Requiring complex or unusual set of actions the user would have to take beyond normal browsing behaviors
- - Unusual software configuration not provided by our Preferences page
 === Alternate Keywords ===