Vulnerability in Mozilla Firefox
CVE-2017-7820
The "instanceof" operator can bypass the Xray wrapper mechanism. When called on web content from the browser itself or an extension the web content can provide its own result for that operator, possibly tricking the browser or extension into mishandling the element. This vulnerability affects Firefox < 56.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N.
EPSS exploit prediction
EPSS: 0.012 (67.0th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 67th percentile — 67.0% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.012 · newest: 0.012 · change: -0.000
Affected products
- Mozilla Firefox — versions unspecified
References
- www.securitytracker.com/id/1039465 (VDB Entry, Third Party Advisory, vdb-entry)
- bugzilla.mozilla.org/show_bug.cgi (Exploit, Issue Tracking)
- www.mozilla.org/security/advisories/mfsa2017-21/ (Vendor Advisory)
- www.securityfocus.com/bid/101057 (VDB Entry, Third Party Advisory, vdb-entry)
Frequently asked questions
- What is CVE-2017-7820?
- CVE-2017-7820 is a medium-severity vulnerability in Mozilla Firefox. CVSS score: 5.3/10. Published 2018-06-11.
- How severe is CVE-2017-7820?
- Medium severity. CVSS v3 base score is 5.3 out of 10.