CVE-2017-7759

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Android intent URLs given to Firefox for Android can be used to navigate from HTTP or HTTPS URLs to local "file:" URLs, allowing for the reading of local data through a violation of same-origin policy. Note: This attack only affects Firefox for Android. Other operating systems are not affected. This vulnerability affects Firefox < 54.

Metrics

CVSS 3.0 7.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
Mozilla	Firefox	>= unspecified, < 54

References

http://www.securityfocus.com/bid/99052Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1038689Third Party Advisory, VDB Entry
https://bugzilla.mozilla.org/show_bug.cgi?id=1356893Exploit, Issue Tracking, Patch
https://www.mozilla.org/security/advisories/mfsa2017-15/Vendor Advisory
http://www.securityfocus.com/bid/99052Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1038689Third Party Advisory, VDB Entry
https://bugzilla.mozilla.org/show_bug.cgi?id=1356893Exploit, Issue Tracking, Patch
https://www.mozilla.org/security/advisories/mfsa2017-15/Vendor Advisory

Timeline

Published: Jun 11, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-77607.8The Mozilla Windows updater modifies some files to be updated by reading the original file and applying changes to it. The location of the o CVE-2017-77615.5The Mozilla Maintenance Service "helper.exe" application creates a temporary directory writable by non-privileged users. When this is combin CVE-2017-77627.5When entered directly, Reader Mode did not strip the username and password section of URLs displayed in the addressbar. This can be used for CVE-2017-77635.3Default fonts on OS X display some Tibetan characters as whitespace. When used in the addressbar as part of an IDN this can be used for doma CVE-2017-77645.3Characters from the "Canadian Syllabics" unicode block can be mixed with characters from other unicode blocks in the addressbar instead of b CVE-2017-77657.5The "Mark of the Web" was not correctly saved on Windows when files with very long names were downloaded from the Internet. Without the Mark CVE-2017-77667.8An attack using manipulation of "updater.ini" contents, used by the Mozilla Windows Updater, and privilege escalation through the Mozilla Ma CVE-2017-77675.5The Mozilla Maintenance Service can be invoked by an unprivileged user to overwrite arbitrary files with junk data using the Mozilla Windows CVE-2017-77685.5The Mozilla Maintenance Service can be invoked by an unprivileged user to read 32 bytes of any arbitrary file on the local system by convinc CVE-2017-77705.9A mechanism where when a new tab is loaded through JavaScript events, if fullscreen mode is then entered, the addressbar will not be rendere CVE-2017-77718.1Out-of-bounds read in Graphite2 Library in Firefox before 54 in graphite2::Pass::readPass function.CVE-2017-77728.8Heap-based Buffer Overflow in Graphite2 library in Firefox before 54 in lz4::decompress function.