Security Severity Ratings/Client: Difference between revisions

Security Severity Ratings/Client (view source)

Revision as of 18:02, 23 June 2026

105 bytes added , 23 June

no edit summary

Tritter

142

edits

@@ Line 68: / Line 68: @@
 * Most Denial of Service vulnerabilities, such as triggering a release assertion or those requiring a browser restart
 |}
-;'''Mitigating Circumstances''':
+|}
-If there are mitigating circumstances that severely constrain the vulnerability, then the issue could be reduced by one level of severity.  Examples of mitigating circumstances include difficulty in reproducing due to very specific timing or load order requirements, a complex or unusual set of actions the user would have to take beyond normal browsing behaviors, or an unusual software configuration not provided by our Preferences page.
+=== Mitigating Circumstances ===
-As a rough guide, to be considered for reduction in severity, the vulnerability should be exploitable less than 10% of the time.  If in the future, default software configurations change or techniques are developed to improve the reliability of the exploit it should be elevated back to the original rating.
+If there are mitigating circumstances that severely constrain the vulnerability, then the issue could be reduced by one or more levels of severity.
-|}
+ - Any bug that requires a user to have an accessibility client installed or using assistive technology is capped at a sec-moderate
+ - Any bug that requires DevTools to have been opened by the user is capped at a sec-moderate
+  - As mentioned above, Memory Safety issues caused by OOM conditions, unless precise triggering of the condition can be shown, are capped at sec-moderate
+ - Similarly unreliable race conditions that crash the browser are also capped at sec-moderate; if the attacker can retry it will not be reduced
+ - Requiring complex or unusual set of actions the user would have to take beyond normal browsing behaviors
+ - Unusual software configuration not provided by our Preferences page