CVE-2016-9902

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

The Pocket toolbar button, once activated, listens for events fired from it's own pages but does not verify the origin of incoming events. This allows content from other origins to fire events and inject content and commands into the Pocket context. Note: this issue does not affect users with e10s enabled. This vulnerability affects Firefox ESR < 45.6 and Firefox < 50.1.

Metrics

CVSS 3.0 7.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-346

Affected software

Vendor	Product	Versions
Mozilla	Firefox ESR	>= unspecified, < 45.6
Mozilla	Firefox	>= unspecified, < 50.1

References

http://rhn.redhat.com/errata/RHSA-2016-2946.htmlThird Party Advisory
http://rhn.redhat.com/errata/RHSA-2016-2973.htmlThird Party Advisory
http://www.securityfocus.com/bid/94885Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1037461Third Party Advisory, VDB Entry
https://bugzilla.mozilla.org/show_bug.cgi?id=1320039Exploit, Issue Tracking, Patch
https://security.gentoo.org/glsa/201701-15Third Party Advisory
https://www.mozilla.org/security/advisories/mfsa2016-94/Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2016-95/Vendor Advisory
http://rhn.redhat.com/errata/RHSA-2016-2946.htmlThird Party Advisory
http://rhn.redhat.com/errata/RHSA-2016-2973.htmlThird Party Advisory
http://www.securityfocus.com/bid/94885Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1037461Third Party Advisory, VDB Entry
https://bugzilla.mozilla.org/show_bug.cgi?id=1320039Exploit, Issue Tracking, Patch
https://security.gentoo.org/glsa/201701-15Third Party Advisory
https://www.mozilla.org/security/advisories/mfsa2016-94/Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2016-95/Vendor Advisory

Timeline

Published: Jun 11, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-99036.1Mozilla's add-ons SDK had a world-accessible resource with an HTML injection vulnerability. If an additional vulnerability allowed this reso CVE-2016-99047.5An attacker could use a JavaScript Map/Set timing attack to determine whether an atom is used by another compartment/zone in specific contex CVE-2016-99058.8A potentially exploitable crash in "EnumerateSubDocuments" while adding or removing sub-documents. This vulnerability affects Firefox ESR < CVE-2016-99076.5Quick Emulator (Qemu) built with the USB redirector usb-guest support is vulnerable to a memory leakage flaw. It could occur while destroyin CVE-2016-99083.3Quick Emulator (Qemu) built with the Virtio GPU Device emulator support is vulnerable to an information leakage issue. It could occur while CVE-2016-99096.1The serializer in html5lib before 0.99999999 might allow remote attackers to conduct cross-site scripting (XSS) attacks by leveraging mishan CVE-2016-99106.1The serializer in html5lib before 0.99999999 might allow remote attackers to conduct cross-site scripting (XSS) attacks by leveraging mishan CVE-2016-99116.5Quick Emulator (Qemu) built with the USB EHCI Emulation support is vulnerable to a memory leakage issue. It could occur while processing pac CVE-2016-99126.5Quick Emulator (Qemu) built with the Virtio GPU Device emulator support is vulnerable to a memory leakage issue. It could occur while destro CVE-2016-99136.5Memory leak in the v9fs_device_unrealize_common function in hw/9pfs/9p.c in QEMU (aka Quick Emulator) allows local privileged guest OS users CVE-2016-99146.5Memory leak in hw/9pfs/9p.c in QEMU (aka Quick Emulator) allows local privileged guest OS users to cause a denial of service (host memory co CVE-2016-99156.5Memory leak in hw/9pfs/9p-handle.c in QEMU (aka Quick Emulator) allows local privileged guest OS users to cause a denial of service (host me