CVE-2017-7821

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A vulnerability where WebExtensions can download and attempt to open a file of some non-executable file types. This can be triggered without specific user interaction for the file download and open actions. This could be used to trigger known vulnerabilities in the programs that handle those document types. This vulnerability affects Firefox < 56.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-732

Affected software

No affected versions have been published.

Timeline

Published: Jun 11, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-78225.3The AES-GCM implementation in WebCrypto API accepts 0-length IV when it should require a length of 1 according to the NIST Special Publicati CVE-2017-78235.4The content security policy (CSP) "sandbox" directive did not create a unique origin for the document, causing it to behave as if the "allow CVE-2017-78249.8A buffer overflow occurs when drawing and validating elements with the ANGLE graphics library, used for WebGL content. This is due to an inc CVE-2017-78255.3Several fonts on OS X display some Tibetan and Arabic characters as whitespace. When used in the addressbar as part of an IDN this can be us CVE-2017-78269.8Memory safety bugs were reported in Firefox 56 and Firefox ESR 52.4. Some of these bugs showed evidence of memory corruption and we presume CVE-2017-78279.8Memory safety bugs were reported in Firefox 56. Some of these bugs showed evidence of memory corruption and we presume that with enough effo CVE-2017-78289.8A use-after-free vulnerability can occur when flushing and resizing layout because the "PressShell" object has been freed while still in use CVE-2017-78295.3It is possible to spoof the sender's email address and display an arbitrary sender address to the email recipient. The real sender's address CVE-2017-78306.5The Resource Timing API incorrectly revealed navigations in cross-origin iframes. This is a same-origin policy violation and could allow for CVE-2017-78315.3A vulnerability where the security wrapper does not deny access to some exposed properties using the deprecated "_exposedProps_" mechanism o CVE-2017-78325.3The combined, single character, version of the letter 'i' with any of the potential accents in unicode, such as acute or grave, can be spoof CVE-2017-78335.3Some Arabic and Indic vowel marker characters can be combined with Latin characters in a domain name to eclipse the non-Latin character with