critical9.8
CVE-2016-9075
An issue where WebExtensions can use the mozAddonManager API to elevate privilege due to privileged pages being allowed in the permissions list.
Impact
An issue where WebExtensions can use the mozAddonManager API to elevate privilege due to privileged pages being allowed in the permissions list. This allows a malicious extension to then install additional extensions without explicit user permission. This vulnerability affects Firefox < 50.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Mozilla | Firefox | before 50.0 |
Weakness classification
References
- NVD record
- CVE.org record
- http://www.securityfocus.com/bid/94337
- http://www.securitytracker.com/id/1037298
- https://bugzilla.mozilla.org/show_bug.cgi?id=1295324
- https://www.mozilla.org/security/advisories/mfsa2016-89/
- http://www.securityfocus.com/bid/94337
- http://www.securitytracker.com/id/1037298
- https://bugzilla.mozilla.org/show_bug.cgi?id=1295324
- https://www.mozilla.org/security/advisories/mfsa2016-89/