CVE-2017-7839

6.1 mediumEPSS 1.1%

Control characters prepended before "javascript:" URLs pasted in the addressbar can cause the leading characters to be ignored and the pasted JavaScript to be executed instead of being blocked. This could be used in social engineering and self-cross-site-scripting (self-XSS) attacks where users are convinced to copy and paste text into the addressbar. This vulnerability affects Firefox < 57.

Severity

CVSS 3.0

6.1 medium

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS: 1.1% chance of exploitation in the next 30 days; higher than 66% of CVEs (scores of 2026-10-31)
CWE: CWE-79
Published: 2018-06-11
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

mozilla:firefox

References

http://www.securityfocus.com/bid/101832
http://www.securitytracker.com/id/1039803
https://bugzilla.mozilla.org/show_bug.cgi?id=1402896
https://www.mozilla.org/security/advisories/mfsa2017-24/
http://www.securityfocus.com/bid/101832

Check your stack JSON