CVE-2017-7830

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

The Resource Timing API incorrectly revealed navigations in cross-origin iframes. This is a same-origin policy violation and could allow for data theft of URLs loaded by users. This vulnerability affects Firefox < 57, Firefox ESR < 52.5, and Thunderbird < 52.5.

Metrics

CVSS 3.0 6.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Affected software

VendorProductVersions
MozillaFirefox>= unspecified, < 57
MozillaFirefox ESR>= unspecified, < 52.5
MozillaThunderbird>= unspecified, < 52.5

References

Timeline

Published
Jun 11, 2018
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2017

CVE-2017-78315.3A vulnerability where the security wrapper does not deny access to some exposed properties using the deprecated "_exposedProps_" mechanism oCVE-2017-78325.3The combined, single character, version of the letter 'i' with any of the potential accents in unicode, such as acute or grave, can be spoofCVE-2017-78335.3Some Arabic and Indic vowel marker characters can be combined with Latin characters in a domain name to eclipse the non-Latin character withCVE-2017-78346.1A "data:" URL loaded in a new tab did not inherit the Content Security Policy (CSP) of the original page, allowing for bypasses of the policCVE-2017-78357.3Mixed content blocking of insecure (HTTP) sub-resources in a secure (HTTPS) document was not correctly applied for resources that redirect fCVE-2017-78367.8The "pingsender" executable used by the Firefox Health Report dynamically loads a system copy of libcurl, which an attacker could replace. TCVE-2017-78375.3SVG loaded through "<img>" tags can use "<meta>" tags within the SVG data to set cookies for that page. This vulnerability affects Firefox <CVE-2017-78385.3Punycode format text will be displayed for entire qualified international domain names in some instances when a sub-domain triggers the punyCVE-2017-78396.1Control characters prepended before "javascript:" URLs pasted in the addressbar can cause the leading characters to be ignored and the pasteCVE-2017-78406.1JavaScript can be injected into an exported bookmarks file by placing JavaScript code into user-supplied tags in saved bookmarks. If the resCVE-2017-78425.3If a document's Referrer Policy attribute is set to "no-referrer" sometimes two network requests are made for "<link>" elements instead of oCVE-2017-78437.5When Private Browsing mode is used, it is possible for a web worker to write persistent data to IndexedDB and fingerprint a user uniquely. I
CVE-2017-7830: Medium severity, CVSS 6.5 | Vulnix