VULNERABILITY INTELLIGENCE
CVE-2015-0819
CVSS score4.3 MEDIUM
EPSS probability2.08%
CISA KEVNot currently listed
Published2015-02-25
Last modified2026-06-17
CVSS vectorAV:N/AC:M/Au:N/C:N/I:P/A:N
Description
The UITour::onPageEvent function in Mozilla Firefox before 36.0 does not ensure that an API call originates from a foreground tab, which allows remote attackers to conduct spoofing and clickjacking attacks by leveraging access to a UI Tour web site.
Primary references
- security@mozilla.org — Third Party Advisory
- security@mozilla.org — Third Party Advisory
- security@mozilla.org — Vendor Advisory
- security@mozilla.org
- security@mozilla.org — Third Party Advisory, VDB Entry
- security@mozilla.org — Third Party Advisory, VDB Entry
- security@mozilla.org — Third Party Advisory
- security@mozilla.org — Issue Tracking
- security@mozilla.org
- af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory
- af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory
- af854a3a-2127-422b-91ae-364da2661108 — Vendor Advisory