I think creating a new login isn't really necessary (since the tab will crash anyway before a malicious process tries to even access it). Regarding the second question, I think, reading POC.patch might help (which compromises a content process in a simple and dirty way) and building a version for verification on your machine: https://firefox-source-docs.mozilla.org/setup/windows_build.html https://firefox-source-docs.mozilla.org/setup/linux_build.html https://firefox-source-docs.mozilla.org/setup/macos_build.html (Just one extra command is required in order to patch it: hg import POC.patch)
Bug 1783504 Comment 63 Edit History
Note: The actual edited comment in the bug view page will always show the original commenter’s name and original timestamp.
I think creating a new login isn't really necessary (since the tab will crash anyway before a compromised process tries to even access it). Regarding the second question, I think, reading POC.patch might help (which compromises a content process in a simple and dirty way) and building a version for verification on your machine: https://firefox-source-docs.mozilla.org/setup/windows_build.html https://firefox-source-docs.mozilla.org/setup/linux_build.html https://firefox-source-docs.mozilla.org/setup/macos_build.html (Just one extra command is required in order to patch it: hg import POC.patch)
I think creating a new login isn't really necessary (since the tab will crash anyway before a compromised process tries to even access it). Regarding the second question, I think, reading POC.patch might help (which compromises a content process in a simple and dirty way) and building a version for verification on your machine: https://firefox-source-docs.mozilla.org/setup/windows_build.html https://firefox-source-docs.mozilla.org/setup/linux_build.html https://firefox-source-docs.mozilla.org/setup/macos_build.html (Just one extra command is required in order to patch it: hg import POC.patch) You can also play with the new setting (dom.security.setdocumenturi). For example, disable it and perform the steps (1-9).
I think creating a new login isn't really necessary (since the tab will crash anyway before a compromised process tries to even access it). Regarding the second question, I think, reading POC.patch might help (which compromises a content process in a simple and dirty way) and building a version for verification on your machine: https://firefox-source-docs.mozilla.org/setup/windows_build.html https://firefox-source-docs.mozilla.org/setup/linux_build.html https://firefox-source-docs.mozilla.org/setup/macos_build.html (Just one extra command is required in order to patch it: hg import POC.patch) You can also play with the new setting (dom.security.setdocumenturi). For example, disable it and perform the steps (2-9).
I think creating a new login isn't really necessary (since the tab will crash anyway before a compromised process tries to even access it). Regarding the second question, I think, reading POC.patch might help (which compromises a content process in a simple and dirty way) and building a version for verification on your machine: https://firefox-source-docs.mozilla.org/setup/windows_build.html https://firefox-source-docs.mozilla.org/setup/linux_build.html https://firefox-source-docs.mozilla.org/setup/macos_build.html (Just one extra command is required in order to patch it: hg import POC.patch) You can also play with the new setting (dom.security.setdocumenturi). For example, disable it and perform the steps (4-9).