CVE-2002-1126 in Mozilla
Summary
by MITRE
Mozilla 1.1 and earlier, and Mozilla-based browsers such as Netscape and Galeon, set the document referrer too quickly in certain situations when a new page is being loaded, which allows web pages to determine the next page that is being visited, including manually entered URLs, using the onunload handler.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/15/2025
This vulnerability resides in the web browser security model of mozilla 1.1 and earlier versions along with mozilla-based browsers including netscape and galeon. The core issue stems from improper handling of the document referrer property during page navigation sequences. When a user navigates from one page to another, the browser should maintain the referer header to indicate the originating page. However, in affected versions, the referrer information is being set prematurely during the page transition process. This timing issue occurs specifically when the onunload handler executes, which is triggered when a page is about to be unloaded or navigated away from. The vulnerability creates a race condition where the referrer is updated before the new page loads, allowing malicious web pages to access the next page URL through javascript execution.
The technical flaw manifests through the improper synchronization of referrer setting operations within the browser's navigation pipeline. When a user clicks a link or enters a URL, the browser begins preparing the navigation sequence. During this process, the current page's onunload event fires, which executes any javascript code associated with that event. In vulnerable implementations, the referrer header is being updated in memory or configuration before the actual navigation occurs, making it accessible to javascript running in the onunload handler. This behavior violates the expected security boundaries between different web contexts and allows for cross-site tracking and potential information leakage. The vulnerability specifically affects the timing of when referrer information is committed to the browser's navigation state, creating an information disclosure channel that should not exist.
The operational impact of this vulnerability extends beyond simple privacy concerns to potentially enable sophisticated tracking mechanisms and cross-site attacks. Malicious websites can exploit this weakness to discover the user's intended navigation path, including manually entered URLs or hidden navigation targets. This information can be used for user profiling, tracking behavior across different sites, or even for social engineering attacks that leverage knowledge of user intentions. The vulnerability essentially allows attackers to perform a form of navigation sniffing that bypasses normal browser security controls. This type of information leakage can be particularly dangerous when users are visiting sensitive sites or performing confidential activities, as the attacker could potentially discover their navigation patterns and target subsequent actions accordingly. The attack vector requires no special privileges and can be executed through standard web page content, making it particularly dangerous in real-world scenarios.
This vulnerability maps to CWE-200 Information Exposure and CWE-352 Cross-Site Request Forgery within the CWE taxonomy, representing a clear violation of information security principles. The issue aligns with ATT&CK technique T1537 for Exfiltration Over Web Service and T1566 for Phishing with Malicious Attachments, as it enables the disclosure of user navigation patterns that could facilitate more sophisticated attacks. The root cause demonstrates poor input validation and improper state management in the browser's navigation handling code. Mitigation strategies should focus on implementing proper synchronization mechanisms for referrer updates, ensuring that referrer information is only set after navigation completion rather than during the unload phase. Browser vendors should enforce stricter timing controls for referrer updates and implement proper isolation between different page contexts during navigation transitions. Users should be encouraged to upgrade to patched versions of affected browsers, as this vulnerability represents a fundamental flaw in the browser's security model that cannot be effectively mitigated through user configuration or temporary workarounds.