CVE-2016-9902

The Pocket toolbar button, once activated, listens for events fired from it's own pages but does not verify the origin of incoming events

published June 11, 2018

CVSS
—
EPSS
1%
Percentile
69.8
In the wild
Unconfirmed
What it is

The Pocket toolbar button, once activated, listens for events fired from it's own pages but does not verify the origin of incoming events. This allows content from other origins to fire events and inject content and commands into the Pocket context. Note: this issue does not affect users with e10s enabled. This vulnerability affects Firefox ESR < 45.6 and Firefox < 50.1.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01290 · 69.8th percentile
Published
2018-06-11T21:00Z
EPSS history
Timeline
  • 11 JUN 21:00Z
    The Pocket toolbar button, once activated, listens for events fired from it's own pages but does not verify the origin of incoming events
    cvelistv5