Security restrictions bypass in Mozilla Firefox - CVE-2017-7820

Vulnerability identifier: #VU8631

CSH Severity: Low

CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

CVE-ID: CVE-2017-7820

CWE-ID: CWE-264

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vendor: Mozilla

Affected software:
Mozilla Firefox

The vulnerability allows a remote attacker to bypass certain security restrictions.

The instanceof operator can bypass the Xray wrapper mechanism. When called on web content from the browser itself or an extension the web content can provide its own result for that operator, possibly tricking the browser or extension into mishandling the element.

Update to version 56.0.

• https://www.mozilla.org/en-US/security/advisories/mfsa2017-21/