CVE-2016-9902: mozilla firefox Origin Validation Error
Vulnerability summary
CVE-2016-9902 is a high (CVSS 7.5) Origin Validation Error vulnerability in mozilla firefox. EPSS estimates a 1.29% chance of exploitation in the next 30 days, higher than 69.8% of scored vulnerabilities. 1 public exploit is recorded.
Advisory lineage
Upstream 0 · Downstream 12 · Related 6Timeline
- 11-06-2018PublishedVulnerability first disclosed.
- 06-08-2024Last modifiedVulnerability information updated.
Description
The Pocket toolbar button, once activated, listens for events fired from it's own pages but does not verify the origin of incoming events. This allows content from other origins to fire events and inject content and commands into the Pocket context. Note: this issue does not affect users with e10s enabled. This vulnerability affects Firefox ESR < 45.6 and Firefox < 50.1.
CVSS metrics
4 scores · 3 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
EPSS trend
Probability
1.29%
Chance of exploitation in the next 30 days
Percentile
70%
Versus all other CVEs
30-day change
-0.03 pp
From 1.32% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (bugzilla.mozilla.org)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Redhat5 products
- enterprise_linux_desktop5.0 | 6.0 | 7.0
- enterprise_linux_server5.0 | 6.0 | 7.0
- enterprise_linux_server_aus7.3 | 7.4
- enterprise_linux_server_eus7.3 | 7.4 | 7.5
- enterprise_linux_workstation5.0 | 6.0 | 7.0
Mozilla2 products
- firefox≥ unspecified, < 50.1 | < 45.6.0 | < 50.1
- firefox_esr≥ unspecified, < 45.6
Debian1 product
- firefox-esr< 45.6.0esr-1
Ubuntu1 product
- firefox< 50.1.0+build2-0ubuntu0.14.04.1 | < 50.1.0+build2-0ubuntu0.16.04.1
4 vendors · 9 products
