Bureaucrats, canmove, Confirmed users
647
edits
Security Severity Ratings/Client: Difference between revisions
Jump to navigation
Jump to search
add detail to frame poisoning description
(Include "code hardening and attack surface reduction" under sec-want) |
(add detail to frame poisoning description) |
||
| Line 251: | Line 251: | ||
* Unexploitable bugs that crash only a content process | * Unexploitable bugs that crash only a content process | ||
* Command injection in Devtools 'Copy as XXX' commands, where the command is not native to the OS in question | * Command injection in Devtools 'Copy as XXX' commands, where the command is not native to the OS in question | ||
* Layout use-after-poison crashes mitigated by frame poisoning | * Layout use-after-poison crashes mitigated by frame poisoning (an <code>nsIFrame</code> object allocated by <code>AllocateByObjectID</code>) | ||
* Attacks that assume physical access to the computer. While certain features of the browser (such as primary password) can mitigate this attack vector, these should not be considered security boundaries. Bypasses of them are considered for improvement on a case-by-case basis and typically are not considered security bugs. | * Attacks that assume physical access to the computer. While certain features of the browser (such as primary password) can mitigate this attack vector, these should not be considered security boundaries. Bypasses of them are considered for improvement on a case-by-case basis and typically are not considered security bugs. | ||
[[Category:Security]] | [[Category:Security]] | ||