1791948 - iframe contents can be arbitrarily drawn outside of iframe.

Status: RESOLVED DUPLICATE of bug 1792643

(Firefox :: Security, task)

Description

[prada960808]

Steps to reproduce:

1. open 'main.html' on Firefox 105.

Actual results:
The content in the iframe is drawn outside of the iframe.

Expected results:
The content in the iframe should not be drawn outside of the iframe.

Severity:
This is vulnerable because the iframe domain (i.e., attacker) can fully cover the page of the main frame (i.e., victim) with any images using CSS margin-left, margin-top, and background-image (or background).

Environment:
Version: Firefox 105.0b5
OS: ubuntu 20.04

How was this issue discovered?

• I used my fuzzer to find this issue.

Comment 1

[prada960808]

Attachment: iframe.html

Comment 2

[prada960808]

Attachment: screenshot.png

Comment 3

[Daniel Veditz [:dveditz]]

This is an incomplete duplicate of 1792643, and missed because it required both "website" and "firefox" security bug permissions to access the bug, and very very few people have both.

Comment 4

[Daniel Veditz [:dveditz]]

The bug bounty was declined simply because it was a duplicate; it's not a judgement on the value of the problem which will be decided in bug 1792643