Closed
Bug 1962313
Opened 1 year ago
Closed 1 year ago
iframe without allow="encrypted-media;" attribute permission can to use encrypted-media;
Categories
(Core :: DOM: Security, defect)
Core
DOM: Security
Tracking
()
RESOLVED
DUPLICATE
of bug 1575033
People
(Reporter: sas.kunz, Unassigned)
References
(Blocks 1 open bug)
Details
(Keywords: reporter-external, Whiteboard: [client-bounty-form])
Attachments
(4 files)
eme.png
I found a vulnerability where iframes without allow="encrypted-media;" attribute permission can to use encrypted-media;
Steps to reproduces:
- open eme.html
- click encrypted media
OS: Windows 11
Firefox Nightly : 139.0a1 (2025-04-23) (64-bit)
Flags: sec-bounty?
|
||
Updated•1 year ago
|
Group: firefox-core-security → core-security
Component: Security → DOM: Security
Product: Firefox → Core
|
||
Updated•1 year ago
|
Group: core-security → dom-core-security
|
||
Comment 4•1 year ago
|
||
We simply don't support this policy, it should be behind the dom.security.featurePolicy.experimental.enabled pref.
|
|
||
Updated•1 year ago
|
Blocks: permissions-policy
|
||
Updated•1 year ago
|
|
|
||
Updated•1 year ago
|
Group: dom-core-security
Flags: sec-bounty? → sec-bounty-
You need to log in
before you can comment on or make changes to this bug.
Description
•