CVE-2016-9075 An issue where WebExtensions can use the mozAddonManager API to elevate privilege due to privileged pages being allowed in the permissions list. This allows a malicious extension to then install addit...
CriticalCVSS 9.8
EPSS 2.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
An issue where WebExtensions can use the mozAddonManager API to elevate privilege due to privileged pages being allowed in the permissions list. This allows a malicious extension to then install additional extensions without explicit user permission. This vulnerability affects Firefox < 50.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| mozilla Firefox | < 50.0 | 50.0 |
| mozilla Firefox | < 50 | 50 |
References
- 94337 third-party-advisory vdb-entry
- 1037298 third-party-advisory vdb-entry
- bugzilla.mozilla.org issue-tracking vendor-advisory
- www.mozilla.org vendor-advisory
- Debian Security Tracker CVE-2016-9075 vendor-advisory