cve/2011/CVE-2011-2366.md

CVE-2011-2366

Description

Mozilla Gecko before 5.0, as used in Firefox before 5.0 and Thunderbird before 5.0, does not block use of a cross-domain image as a WebGL texture, which allows remote attackers to obtain approximate copies of arbitrary images via a timing attack involving a crafted WebGL fragment shader.

POC

Reference

• https://bugzilla.mozilla.org/show_bug.cgi?id=655987
• https://bugzilla.mozilla.org/show_bug.cgi?id=656277
• https://bugzilla.mozilla.org/show_bug.cgi?id=659349
• https://hacks.mozilla.org/2011/06/cross-domain-webgl-textures-disabled-in-firefox-5/

Github

No PoCs found on GitHub currently.