description: Activity Stream can display content from sent from the Snippet Service website. This content is written to innerHTML on the Activity Stream page without sanitization, allowing for a potential access to other information available to the Activity Stream, such as browsing history, if the Snipper Service were compromised. This vulnerability affects Firefox < 68.
problem types: Activity Stream writes unsanitized content to innerHTML
affected:
{
product: Firefox
vendor: Mozilla
versions:
lessThan: 68, status: affected, version: unspecified, versionType: custom
}