1906543 - Cross-Site Scripting (XSS) vulnerability in Firefox's PDF Viewer

Status: RESOLVED INVALID

(Firefox :: Security, defect)

Description

[Ranjan]

Attachment: XSS_POC.pdf

Vulnerability Details
Description: XSS vulnerability observed when opening a PDF file in Firefox.
Impact: Potential for malicious script execution within the browser context.

Steps to Reproduce

Environment Setup:
    Operating System: windows 11
    Browser: Firefox 127.0.2 (64-bit)

Reproduction Steps:
    Open Firefox.
   1.open the provided attached file
  2. Observe XSS payload execution [ when you open the file in firefox xss poped up].

4. Proof of Concept (PoC)

   Payload: Include the specific XSS payload used for demonstration.
   Screenshot/Video: Attach screenshots or a video demonstrating the XSS behavior.

Comment 1

[Daniel Veditz [:dveditz]]

There is no cross-site scripting here: the script is sandboxed in the PDF context.
https://blog.mozilla.org/attack-and-defense/2021/10/14/implementing-form-filling-and-accessibility-in-the-firefox-pdf-viewer/
https://textslashplain.com/2024/04/10/browser-security-bugs-that-arent-javascript-in-pdf/