Bypassing Firefox's HTML Sanitizer API

Summary: PortSwigger researcher Gareth Heyes found that Firefox's experimental HTML Sanitizer API blocked SVG imports via data URLs and relative URLs but allowed same-origin absolute URLs, so an uploaded SVG protected only by Content-Disposition: attachment could still execute arbitrary JavaScript. The bug was reported to Mozilla on 2022-02-25, fixed on 2022-04-29, and shipped in Firefox 102.0 on 2022-06-28.
Key Takeaway: The bypass turned a standard mitigation - forcing a download on uploaded SVG files - into a false sense of safety, and it sat unfixed for roughly two months after disclosure.

Read the original at PortSwigger Research ↗

Topics: Vulnerabilities & Patching
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026