CVE-2017-7770

A mechanism where when a new tab is loaded through JavaScript events, if fullscreen mode is then entered, the addressbar will not be rendered

published June 11, 2018

CVSS
—
EPSS
1%
Percentile
65.4
In the wild
Unconfirmed
What it is

A mechanism where when a new tab is loaded through JavaScript events, if fullscreen mode is then entered, the addressbar will not be rendered. This would allow a malicious site to displayed a spoofed addressbar, showing the location of an arbitrary website instead of the one loaded. Note: this issue only affects Firefox for Android. Desktop Firefox is unaffected. This vulnerability affects Firefox < 54.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01110 · 65.4th percentile
Published
2018-06-11T21:00Z
EPSS history
Timeline
  • 11 JUN 21:00Z
    A mechanism where when a new tab is loaded through JavaScript events, if fullscreen mode is then entered, the addressbar will not be rendered
    cvelistv5