Website permission grant via unvalidated IPC data

Permission confusion in Mozilla Firefox before 70 allows remote attackers to grant a website an attacker-chosen permission after user approval. The browser-plugins parent handler trusts a permission string received from a compromised content process and passes it to Services.perms.addFromPrincipal instead of deriving it from trusted plug-in data. Exploitation requires a separate content-process compromise and acceptance of the Click to Play prompt; the resulting impact is limited to a permission granted to an attacker-selected host.