CVE-2004-1381
Firefox < 1.0 and Mozilla < 1.7.5 - Input Focus Spoofing via Background Tab
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2004-1381. PoCs published by Jakob Balle.
AI-analyzed exploit summary This is a proof-of-concept for a cross-site scripting (XSS) vulnerability that captures keystrokes from a user interacting with the CitiBank website. The exploit uses an onMouseOver event to continuously focus on a hidden form field, logging keystrokes entered on the target site.
Description
Firefox before 1.0 and Mozilla before 1.7.5 allow inactive (background) tabs to focus on input being entered in the active tab, as originally reported using form fields, which allows remote attackers to steal sensitive data that is intended for other sites, which could facilitate phishing attacks.
Exploits (1)
This is a proof-of-concept for a cross-site scripting (XSS) vulnerability that captures keystrokes from a user interacting with the CitiBank website. The exploit uses an onMouseOver event to continuously focus on a hidden form field, logging keystrokes entered on the target site.