Activity Stream is vulnerable to cross-site scripting (XSS). It can display content from sent from the Snippet Service website. This content is written to innerHTML on the Activity Stream page without sanitization, allowing for a potential access to other information available to the Activity Stream, such as browsing history, if the Snipper Service were compromised.
CPE | Name | Operator | Version |
---|---|---|---|
firefox:xenial | eq | 45.0.2+build1 | |
firefox:bionic | eq | 59.0.2+build1 | |
firefox:xenial | eq | 45.0.2+build1 | |
firefox:bionic | eq | 59.0.2+build1 |