CVE-2016-1949

Mozilla Firefox before 44.0.2 does not properly restrict the interaction between Service Workers and plugins, which allows remote attackers to bypass the Same…

published February 13, 2016

CVSS
—
EPSS
2%
Percentile
74.0
In the wild
Unconfirmed
What it is

Mozilla Firefox before 44.0.2 does not properly restrict the interaction between Service Workers and plugins, which allows remote attackers to bypass the Same Origin Policy via a crafted web site that triggers spoofed responses to requests that use NPAPI, as demonstrated by a request for a crossdomain.xml file.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01503 · 74.0th percentile
Published
2016-02-13T02:00Z
EPSS history
Timeline
  • 13 FEB 02:00Z
    Mozilla Firefox before 44.0.2 does not properly restrict the interaction between Service Workers and plugins, which allows remote attackers to bypass the Same…
    cvelistv5