Mozilla Firefox CVE-2016-5260 Information Disclosure Vulnerability

description-logoDescription

Mozilla employee Mike Kaply reported that the Firefox session restore data can contain passwords in plain text if a password input field on a page has its type changed from "password" to "text" during a session. This can occur if the password input field has a scripted mechanism to display the password to the user. Once this type is changed, the password data will persist as clear text within stored form data for this page. This could result in a potential revelation of site passwords on sites that use this mechanism to display password data if an attacker could find a way to read the session restoration file.

affected-products-logoAffected Applications

Firefox

CVE References

CVE-2016-5260