By observing the stack trace for JavaScript errors in web workers, it was possible to leak the result of a cross-origin redirect. This applied only to content that can be parsed as script. This vulnerability affects Firefox < 79, Firefox ESR < 68.11, Firefox ESR < 78.1, Thunderbird < 68.11, and Thunderbird < 78.1.
The product does not properly verify that the source of data or communication is valid.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Firefox | Mozilla | * | 79.0 (excluding) |
| Firefox_esr | Mozilla | * | 68.11 (excluding) |
| Firefox_esr | Mozilla | 78.0 (including) | 78.1 (excluding) |
| Thunderbird | Mozilla | * | 68.11 (excluding) |
| Thunderbird | Mozilla | 78.0 (including) | 78.1 (excluding) |