ID:5010 - Exploit for Origin validation error in Mozilla Firefox and Firefox ESR - CVE-2020-16012

Link to public exploit:

Vulnerability description

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to the way browser handles requests to cross-origin images. When drawing a transparent image on top of an unknown cross-origin image, the Skia library drawImage function takes a variable amount of time depending on the content of the underlying image. This results in cross-origin information exposure of image content through timing side-channel attacks.

Remediation