description: When pasting a &lt;style&gt; tag from the clipboard into a rich text editor, the CSS sanitizer incorrectly rewrites a @namespace rule. This could allow for injection into certain types of websites resulting in data exfiltration. This vulnerability affects Firefox ESR < 68.4 and Firefox < 72.
problem types: Bypass of @namespace CSS sanitization during pasting
affected:
{
product: Firefox ESR
vendor: Mozilla
versions:
status: affected, version: before 68.4
}
{
product: Firefox
vendor: Mozilla
versions:
status: affected, version: before 72
}
