Collected research

Firefox XML injection into parse of remote XML

CESA-2008-010

Chris Evans · scary.beasts.org

Firefox's E4X support makes inline XML valid JavaScript, so a remote site can pull a victim's private XML feed in via <script src>. An XML injection bug in E4X parsing lets `default xml namespace = '\''` break the parse of the included document, leaking limited structure about it. CVE-2008-5024, fixed in Firefox 2.0.0.18 and 3.0.4.

Record

Document

CESA-2008-010

Researcher

Chris Evans

Published by

scary.beasts.org

Topic

Injection

In the archive

• Collected in the 2008 research round

Tags

• sop-bypass
• same-origin-policy
• info-leak
• javascript
• injection
• cve
• owasp-a01-2021
• owasp-a03-2021

This page is the archive's own catalogue record. The research is the work of Chris Evans, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 11 August 2026.