4
edits
Security Severity Ratings/Client: Difference between revisions
Jump to navigation
Jump to search
Added frame poisoning note
(Fix typos) |
(Added frame poisoning note) |
||
| Line 250: | Line 250: | ||
* Unexploitable bugs that crash only a content process | * Unexploitable bugs that crash only a content process | ||
* Command injection in Devtools 'Copy as XXX' commands, where the command is not native to the OS in question | * Command injection in Devtools 'Copy as XXX' commands, where the command is not native to the OS in question | ||
* Layout use-after-poison crashes mitigated by frame poisoning | |||
* Attacks that assume physical access to the computer. While certain features of the browser (such as primary password) can mitigate this attack vector, these should not be considered security boundaries. Bypasses of them are considered for improvement on a case-by-case basis and typically are not considered security bugs. | * Attacks that assume physical access to the computer. While certain features of the browser (such as primary password) can mitigate this attack vector, these should not be considered security boundaries. Bypasses of them are considered for improvement on a case-by-case basis and typically are not considered security bugs. | ||
[[Category:Security]] | [[Category:Security]] | ||