142
edits
Security Severity Ratings/Client: Difference between revisions
Update the severity of spoofing bugs
(Update the severity of spoofing bugs) |
|||
| Line 29: | Line 29: | ||
* Memory Safety issues, unless constrained e.g. by OOM conditions | * Memory Safety issues, unless constrained e.g. by OOM conditions | ||
* Theft of arbitrary files from local system | * Theft of arbitrary files from local system | ||
* Domain spoofing that | * Domain spoofing that allows arbitrary attacker controlled HTML, that a user can interact with, with an attacker-controlled URL in the actual address bar retaining normal badging and iconography | ||
* JavaScript injection into browser chrome or other origins | * JavaScript injection into browser chrome or other origins | ||
* Failure to use TLS where needed to ensure confidential/security | * Failure to use TLS where needed to ensure confidential/security | ||
| Line 45: | Line 45: | ||
| | | | ||
* Memory Safety issues caused by OOM conditions; unless precise triggering of the condition can be shown | * Memory Safety issues caused by OOM conditions; unless precise triggering of the condition can be shown | ||
* Private Browsing Mode data leaks discoverable in the Browser UI (excepting user-directed actions like Bookmarks) | * Private Browsing Mode data leaks discoverable in the Browser UI (excepting user-directed actions like Bookmarks) | ||
* Private Browsing Mode data leaks to disk on Desktop | * Private Browsing Mode data leaks to disk on Desktop | ||
| Line 62: | Line 60: | ||
| | | | ||
* Private Browsing Mode data leaks to disk on Mobile, excepting data cleaned on startup due to process reaping | * Private Browsing Mode data leaks to disk on Mobile, excepting data cleaned on startup due to process reaping | ||
* Techniques that cause a JavaScript alert to be shown with a different domain than the one in the address bar (or one of its nested browsing contexts) | * Techniques that put the browser into fullscreen mode without user interaction or while obscuring the notification | ||
* Techniques that overlay the address bar with another piece of browser chrome to obscure it | |||
* Techniques that cause a JavaScript alert or similar browser modal to be shown with a different domain than the one in the address bar (or one of its nested browsing contexts) | |||
* Detection of a previous visit to a specific site, or when the affected site has a certain configuration | * Detection of a previous visit to a specific site, or when the affected site has a certain configuration | ||
* Identification of users by profiling browsing behavior. | * Identification of users by profiling browsing behavior. | ||