CVE-2016-2817

🗓️ 30 Apr 2016 17:00:00Reported by mozillaType

cve🔗 web.nvd.nist.gov👁 119 Views🌐 WEB

The WebExtension sandbox feature in Mozilla Firefox prior to 46.0 allows remote attackers to conduct UXSS attacks via crafted extension

Reporter	Title	Published	Views	Family All 40
FreeBSD	mozilla -- multiple vulnerabilities	26 Apr 201600:00	–	freebsd
Tenable Nessus	Mozilla Firefox < 46.0 Multiple Vulnerabilities	24 Jun 201600:00	–	nessus
Tenable Nessus	FreeBSD : mozilla -- multiple vulnerabilities (92d44f83-a7bf-41cf-91ee-3d1b8ecf579f)	27 Apr 201600:00	–	nessus
Tenable Nessus	GLSA-201701-15 : Mozilla Firefox, Thunderbird: Multiple vulnerabilities (SWEET32)	4 Jan 201700:00	–	nessus
Tenable Nessus	Firefox < 46 Multiple Vulnerabilities (Mac OS X)	29 Apr 201600:00	–	nessus
Tenable Nessus	Firefox < 46 Multiple Vulnerabilities	29 Apr 201600:00	–	nessus
Tenable Nessus	openSUSE Security Update : MozillaFirefox / mozilla-nss (openSUSE-2016-541)	6 May 201600:00	–	nessus
Tenable Nessus	openSUSE Security Update : Firefox 46.0 (openSUSE-2016-566) (SWEET32)	12 May 201600:00	–	nessus
Tenable Nessus	Ubuntu 12.04 LTS / 14.04 / 15.10 / 16.04 : firefox vulnerabilities (USN-2936-1) (deprecated)	2 May 201600:00	–	nessus
Tenable Nessus	Ubuntu 12.04 LTS : oxygen-gtk3 update (USN-2936-2)	3 May 201600:00	–	nessus

NVD

Node

mozilla firefoxRange≤45.0.2

Source	Link
security	www.security.gentoo.org/glsa/201701-15
mozilla	www.mozilla.org/security/announce/2016/mfsa2016-46.html
lists	www.lists.opensuse.org/opensuse-security-announce/2016-05/msg00005.html
bugzilla	www.bugzilla.mozilla.org/show_bug.cgi
securitytracker	www.securitytracker.com/id/1035692
lists	www.lists.opensuse.org/opensuse-updates/2016-05/msg00038.html
ubuntu	www.ubuntu.com/usn/USN-2936-2
ubuntu	www.ubuntu.com/usn/USN-2936-1
ubuntu	www.ubuntu.com/usn/USN-2936-3

Parameter	Position	Path	Description	CWE
url	path	javascript:	UXSS via crafted extension accessing javascript: URL through chrome.tabs.create/update API calls	CWE-264
url	path	data:	UXSS via crafted extension accessing data: URL through chrome.tabs.create/update API calls	CWE-264

17 Jun 2026 00:44Current

6.2Medium risk

Vulners AI Score6.2

CVSS 24.3

CVSS 35.4

EPSS0.01252