Open Bug 1560204 Opened 6 years ago Updated 3 years ago

wininet.dll loaded in content process by webrtc to detect web proxy

Categories

(Core :: Security: Process Sandboxing, defect, P3)

Product:
Core
Component:
Security: Process Sandboxing
Type:
defect

Tracking

()

Tracking Flags:
Tracking Status
firefox69 --- affected

People

(Reporter: bobowen, Unassigned)

Details

webrtc is capable of routing media through a web proxy, mostly for enterprise cases, but sometimes for privacy reasons.
As part of this it uses things from wininet.dll, which is a problem for moving to untrusted and USER_LOCKDOWN.
We can potentially load that before lockdown, but the calls themselves might be blocked.

Priority: -- → P3
Severity: normal → S3
You need to log in before you can comment on or make changes to this bug.