CVE-2019-9797

MEDIUM

Firefox < 66.0 - Same-Origin Policy Bypass via createImageBitmap and Canvas Rendering

Title source: llm
STIX 2.1

Description

Cross-origin images can be read in violation of the same-origin policy by exporting an image after using createImageBitmap to read the image and then rendering the resulting bitmap image within a canvas element. This vulnerability affects Firefox < 66.

References (19)

Core 19
Core References
Issue Tracking, Permissions Required, Vendor Advisory x_refsource_misc
https://bugzilla.mozilla.org/show_bug.cgi?id=1528909
Mailing List mailing-list x_refsource_bugtraq
https://seclists.org/bugtraq/2019/May/56
Mailing List mailing-list x_refsource_bugtraq
https://seclists.org/bugtraq/2019/May/59
Third Party Advisory vendor-advisory x_refsource_debian
https://www.debian.org/security/2019/dsa-4448
Mailing List mailing-list x_refsource_mlist
https://lists.debian.org/debian-lts-announce/2019/05/msg00032.html
Vendor Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2019:1265
Vendor Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2019:1267
Vendor Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2019:1269
Third Party Advisory vendor-advisory x_refsource_debian
https://www.debian.org/security/2019/dsa-4451
Mailing List mailing-list x_refsource_bugtraq
https://seclists.org/bugtraq/2019/May/67
Mailing List mailing-list x_refsource_mlist
https://lists.debian.org/debian-lts-announce/2019/05/msg00038.html
Vendor Advisory vendor-advisory x_refsource_ubuntu
https://usn.ubuntu.com/3997-1/
Vendor Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2019:1310
Vendor Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2019:1308
Vendor Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2019:1309

Scores

CVSS v3 5.3
EPSS 0.0048
EPSS Percentile 65.3%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Details

CWE
CWE-346
Status published
Products (1)
mozilla/firefox < 66.0
Published Apr 26, 2019
Tracked Since Feb 18, 2026