CVE-2020-15652: 
NixOS vulnerability analysis and mitigation

CVE-2020-15652 is a high-impact security vulnerability discovered in Mozilla Firefox and Thunderbird browsers that was disclosed on July 28, 2020. The vulnerability allowed potential leakage of redirect targets when loading scripts in web workers. This vulnerability affected Firefox versions < 79, Firefox ESR < 68.11, Firefox ESR < 78.1, Thunderbird < 68.11, and Thunderbird < 78.1 (Mozilla Advisory).

The vulnerability occurs when observing the stack trace for JavaScript errors in web workers. When a worker imports a cross-origin resource that performs a redirect and successfully parses as valid JavaScript, contributing callable functions to the global scope during top-level evaluation, the thrown exception reveals the final URI of the channel that loaded, potentially exposing private information. This vulnerability is particularly relevant for sites using SameSite=None cookies and exposing redirectors that act on the cookie (Mozilla Advisory).

The vulnerability could allow an attacker to leak sensitive information from cross-origin redirects, such as authorization tokens, CSRF tokens, or other sensitive data included in URLs. A real-world example involved a CSRF vulnerability in Google services that could lead to credential hijacking (Bugzilla).

The vulnerability was confirmed to be exploitable in practice. It required the loaded resource to either define functions in the global scope or call functions defined before in the worker's context. Common JavaScript libraries like jQuery, Angular, or parts of them could be used for exploitation. Additionally, JSONP endpoints could be utilized instead of JS resources (Bugzilla).

The vulnerability was patched in Firefox 79, Firefox ESR 68.11, Firefox ESR 78.1, Thunderbird 68.11, and Thunderbird 78.1. The fix involved implementing proper cross-origin checks to prevent the leakage of redirect targets in web worker stack traces. Users were advised to update their browsers to these versions or later (Mozilla Advisory).