Threats tagged 'ghsa-rf6g-cf9f-g4v7'

A vulnerability in Firefox and Thunderbird prior to versions 144 and ESR 140.4 allowed a malicious web page to use the type attribute of an OBJECT tag to override the browser's default behavior when handling web resources served without a content-type header. This behavior could contribute to cross-site scripting (XSS) attacks on sites that improperly serve files without specifying a content-type header. The issue was addressed in Firefox 144 and Thunderbird 144 as well as Firefox ESR 140.4 and Thunderbird ESR 140.4.