VULNERABILITY INTELLIGENCE
CVE-2015-0816
CVSS score5 MEDIUM
EPSS probability66.94%
CISA KEVNot currently listed
Published2015-04-01
Last modified2026-06-17
CVSS vectorAV:N/AC:L/Au:N/C:N/I:P/A:N
Description
Mozilla Firefox before 37.0, Firefox ESR 31.x before 31.6, and Thunderbird before 31.6 do not properly restrict resource: URLs, which makes it easier for remote attackers to execute arbitrary JavaScript code with chrome privileges by leveraging the ability to bypass the Same Origin Policy, as demonstrated by the resource: URL associated with PDF.js.