Executing arbitrary JavaScript from third-party origin when processing HTTP Basic Auth in Firefox, the story behind Bugzilla 1944926 and no CVE.

All opinions in this post are my own (and my colleague’s), and do not represent any employer, organization, or institution with which we are or have been affiliated. Whenever I’m asked for a password on the web, I try to be deliberately boring. This is a simplified explanation for the sake of the article , but the habit is basically: I prefer using bookmarked URLs (or typed URLs I’ve used a…