Address bar spoofing in Mozilla Firefox - CVE-2017-5463
Published: April 19, 2017
Vulnerability identifier: #VU6340
CSH Severity: Low
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2017-5463
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to spoof browser address bar.
The vulnerability exists due to an error when processing reader view. Android intents can be used to launch Firefox for Android in reader mode with a user specified URL. This allows an attacker to spoof the contents of the addressbar as displayed to users.
This vulnerability affects only Firefox for Android.
Affected software
Mozilla Firefox
How to mitigate CVE-2017-5463
Update to Firefox 53.