Firefox – Same-Origin Policy Bypass (CVE-2015-7188)

They have fixed it, no? <a href="https:&#x2F;&#x2F;bugzilla.mozilla.org&#x2F;show_bug.cgi?id=1199430" rel="nofollow">https:&#x2F;&#x2F;bugzilla.mozilla.org&#x2F;show_bug.cgi?id=1199430</a>

Title seems misleading. The same-origin bypass is via Flash. The Firefox portion is having a funky URL&#x2F;hostname, which Flash then uses (edit: mis-parses).

Very interesting exploit. I wonder what else is affected by IP addresses parsing issues.