Mozilla Firefox 68 : Activity Stream can display content from sent from the Snippet Service website. This content is written to <code>innerHTML</code> on the Activity Stream page without sanitization, allowing for a potential access to other information available to the Activity Stream, such as browsing history, if the Snipper Service were compromised.