CISA KEV catalog
Confirmed active exploitation.
Listed in CISA's catalog of Known Exploited Vulnerabilities: attackers are using it in real attacks. Patch it with priority.
- Name
- Mozilla Firefox Security Feature Bypass Vulnerability
- Added to catalog
- Remediation due date (US federal)
- Required action
- Apply updates per vendor instructions.
Description
The PDF reader in Mozilla Firefox before 39.0.3, Firefox ESR 38.x before 38.1.1, and Firefox OS before 2.2 allows remote attackers to bypass the Same Origin Policy, and read arbitrary files or gain privileges, via vectors involving crafted JavaScript code and a native setter, as exploited in the wild in August 2015.
Affected products
mozilla: firefox; mozilla: firefox os; oracle: solaris; canonical: ubuntu linux; redhat: enterprise linux desktop; redhat: enterprise linux eus; redhat: enterprise linux server; redhat: enterprise linux server aus; redhat: enterprise linux server tus; redhat: enterprise linux workstation; suse: linux enterprise debuginfo; opensuse: opensuse; suse: linux enterprise desktop; suse: linux enterprise server; suse: linux enterprise software development kit
References10
- www.mozilla.org/security/announce/2015/mfsa2015-78.html Vendor Advisory
- blog.mozilla.org/security/2015/08/06/firefox-exploit-found-in-t… Issue TrackingVendor Advisory
- www.mozilla.org/security/announce/2015/mfsa2015-78.html Vendor Advisory
- blog.mozilla.org/security/2015/08/06/firefox-exploit-found-in-t… Issue TrackingVendor Advisory
- www.oracle.com/technetwork/topics/security/bulletinapr2016-2952… PatchThird Party Advisory
- www.oracle.com/technetwork/topics/security/bulletinapr2016-2952… PatchThird Party Advisory
- www.exploit-db.com/exploits/37772/ ExploitThird Party AdvisoryVDB Entry
- www.exploit-db.com/exploits/37772/ ExploitThird Party AdvisoryVDB Entry
- lists.opensuse.org/opensuse-security-announce/2015-08/msg00009.… Mailing ListThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2015-08/msg00010.… Mailing ListThird Party Advisory
Metrics
- CVSS 3.1
-
8.8
HIGH
Score source: NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - EPSS — exploit probability
- 69% percentile: 99 · as of 2 November 2026
- CWE
- CWE-346