CSS Sanitizer Incorrectly Rewrites @namespace Rule in Firefox ESR < 68.4 and Firefox < 72, Allowing for Data Exfiltration

CSS Sanitizer Incorrectly Rewrites @namespace Rule in Firefox ESR < 68.4 and Firefox < 72, Allowing for Data Exfiltration

CVE-2019-17016 · MEDIUM Severity

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

When pasting a &lt;style&gt; tag from the clipboard into a rich text editor, the CSS sanitizer incorrectly rewrites a @namespace rule. This could allow for injection into certain types of websites resulting in data exfiltration. This vulnerability affects Firefox ESR < 68.4 and Firefox < 72.

Learn more about our Web App Pen Testing.