Address bar spoofing in Mozilla Firefox - CVE-2017-5452
Published: April 19, 2017
Vulnerability identifier: #VU6342
CSH Severity: Low
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2017-5452
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to spoof browser address bar.
The vulnerability exists due to an error during scrolling with editable content. Malicious sites can display a spoofed addressbar on a page when the existing location bar on the new page is scrolled out of view if an HTML editable page element is user selected.
This vulnerability affects only Firefox for Android.
Affected software
Mozilla Firefox
How to mitigate CVE-2017-5452
Update to Firefox 53.