CVE-2020-15652

What it actually does

Observing stack traces from JavaScript errors inside web workers allows leakage of cross-origin redirect results when the content is parsable as script.

Why it matters to the business

Attackers may obtain sensitive navigation or redirect information that could assist targeted follow-on attacks against users of affected browsers.

How an attack unfolds

An attacker hosts or compromises a site that triggers a cross-origin redirect to script-parsable content inside a web worker, forces a JavaScript error, and reads the resulting stack trace to recover the redirect destination.

How to fix it

Upgrade Firefox to 79 or later, Firefox ESR to 68.11 or 78.1 or later, and Thunderbird to 68.11 or 78.1 or later. Apply vendor updates as soon as available for any downstream distributions.

How to confirm the fix worked

Confirm browser versions meet or exceed the fixed releases listed by the vendor; re-test cross-origin redirect behavior in web workers to ensure stack traces no longer expose redirect targets.

Typical attack path

1. Lure victim to attacker-controlled page that loads malicious script in a web worker
2. Trigger cross-origin redirect to target resource parsable as script
3. Induce JavaScript error whose stack trace is observable
4. Extract redirect target from the leaked stack trace

How to detect it

Review web server or proxy logs for unusual sequences of cross-origin requests followed by worker script loads; browser telemetry or crash reports showing stack traces containing redirect URLs may indicate attempted exploitation.

What your security team should do

• Prioritize browser and mail client updates across all endpoints
• Monitor vendor advisories for any additional affected products
• Educate users on keeping browsers current given the age of the disclosure