CVE-2017-5392

Weak proxy objects have weak references on multiple threads when they should only have them on one, resulting in incorrect memory usage and corruption, which leads to potentially exploitable crashes. Note: This issue only affects Firefox for Android. Other operating systems are not affected. This vulnerability affects Firefox < 51.

• CWE-119

• http://www.securityfocus.com/bid/95763Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1037693Third Party Advisory, VDB Entry
• https://bugzilla.mozilla.org/show_bug.cgi?id=1293709Issue Tracking, Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2017-01/Vendor Advisory
• http://www.securityfocus.com/bid/95763Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1037693Third Party Advisory, VDB Entry
• https://bugzilla.mozilla.org/show_bug.cgi?id=1293709Issue Tracking, Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2017-01/Vendor Advisory

Published

Jun 11, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-5386WebExtension scripts can use the "data:" protocol to affect …
• CVE-2017-5387The existence of a specifically requested local file can be …
• CVE-2017-5388A STUN server in conjunction with a large number of "webkitR…
• CVE-2017-5389WebExtensions could use the "mozAddonManager" API by modifyi…
• CVE-2017-5390The JSON viewer in the Developer Tools uses insecure methods…
• CVE-2017-5391Special "about:" pages used by web content, such as RSS feed…
• CVE-2017-5393The "mozAddonManager" allows for the installation of extensi…
• CVE-2017-5394A location bar spoofing attack where the location bar of loa…
• CVE-2017-5395Malicious sites can display a spoofed location bar on a subs…
• CVE-2017-5396A use-after-free vulnerability in the Media Decoder when wor…
• CVE-2017-5397The cache directory on the local file system is set to be wo…
• CVE-2017-5398Memory safety bugs were reported in Thunderbird 45.7. Some o…