perhaps all of us use no-Script when we visit untrusted web pages to block all scripts plugins etc. but still there is something beside plain HTML codes that we don't block; SSL connection! in Https protocol any web page can send crypto data to us which is handled by Firefox NSS lib and its almost always based on two thing, AES and RSA. from my opinion Encrypting or Decrypting received data from untrusted site must be safe because crypto libs are not like a flash player that give ability to attacker to make endless possible codes and run.. for example in AES its just processing each byte with a few known cycles to encrypt it or decrypt it and both are almost same and in RSA its just a math function on a number, why should calculating numbers cause a buffer-overflow? the question is :
- is that possible make a compromise with AES encryption / decryption ?
- is that possible make a compromise with RSA decryption (if attacker know private key or don't know)