CVE-2014-1483

Mozilla Firefox before 27.0 and SeaMonkey before 2.24 allow remote attackers to bypass the Same Origin Policy and obtain sensitive information by using an IFRAME element in conjunction with certain timing measurements involving the document.caretPositionFromPoint and document.elementFromPoint functions.

• CWE-1021

• http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00004.htmlMailing List, Third Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00010.htmlMailing List, Third Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00017.htmlMailing List, Third Party Advisory
• http://osvdb.org/102869Broken Link
• http://secunia.com/advisories/56706Broken Link
• http://secunia.com/advisories/56767Broken Link
• http://secunia.com/advisories/56787Broken Link
• http://secunia.com/advisories/56888Broken Link
• http://www.mozilla.org/security/announce/2014/mfsa2014-05.htmlVendor Advisory
• http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.htmlThird Party Advisory
• http://www.securityfocus.com/bid/65316Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1029717Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1029720Third Party Advisory, VDB Entry
• http://www.ubuntu.com/usn/USN-2102-1Third Party Advisory
• http://www.ubuntu.com/usn/USN-2102-2Third Party Advisory
• https://8pecxstudios.com/?page_id=44080Broken Link, URL Repurposed
• https://bugzilla.mozilla.org/show_bug.cgi?id=950427Issue Tracking, Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/90893Third Party Advisory, VDB Entry
• https://security.gentoo.org/glsa/201504-01Third Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00004.htmlMailing List, Third Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00010.htmlMailing List, Third Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00017.htmlMailing List, Third Party Advisory
• http://osvdb.org/102869Broken Link
• http://secunia.com/advisories/56706Broken Link
• http://secunia.com/advisories/56767Broken Link
• http://secunia.com/advisories/56787Broken Link
• http://secunia.com/advisories/56888Broken Link
• http://www.mozilla.org/security/announce/2014/mfsa2014-05.htmlVendor Advisory
• http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.htmlThird Party Advisory
• http://www.securityfocus.com/bid/65316Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1029717Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1029720Third Party Advisory, VDB Entry
• http://www.ubuntu.com/usn/USN-2102-1Third Party Advisory
• http://www.ubuntu.com/usn/USN-2102-2Third Party Advisory
• https://8pecxstudios.com/?page_id=44080Broken Link, URL Repurposed
• https://bugzilla.mozilla.org/show_bug.cgi?id=950427Issue Tracking, Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/90893Third Party Advisory, VDB Entry
• https://security.gentoo.org/glsa/201504-01Third Party Advisory

Published

Feb 6, 2014

Last Modified

Jun 17, 2026

Status

Modified

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2014-1477Multiple unspecified vulnerabilities in the browser engine i…9.8
• CVE-2014-1478Multiple unspecified vulnerabilities in the browser engine i…
• CVE-2014-1479The System Only Wrapper (SOW) implementation in Mozilla Fire…7.5
• CVE-2014-1480The file-download implementation in Mozilla Firefox before 2…
• CVE-2014-1481Mozilla Firefox before 27.0, Firefox ESR 24.x before 24.3, T…7.5
• CVE-2014-1482RasterImage.cpp in Mozilla Firefox before 27.0, Firefox ESR …8.8
• CVE-2014-1484Mozilla Firefox before 27.0 on Android 4.2 and earlier creat…
• CVE-2014-1485The Content Security Policy (CSP) implementation in Mozilla …
• CVE-2014-1486Use-after-free vulnerability in the imgRequestProxy function…9.8
• CVE-2014-1487The Web workers implementation in Mozilla Firefox before 27.…7.5
• CVE-2014-1488The Web workers implementation in Mozilla Firefox before 27.…
• CVE-2014-1489Mozilla Firefox before 27.0 does not properly restrict acces…