CVE-2017-5420

A "javascript:" url loaded by a malicious page can obfuscate its location by blanking the URL displayed in the addressbar, allowing for an attacker to spoof an existing page without the malicious page's address being displayed correctly. This vulnerability affects Firefox < 52.

• CWE-20

• http://www.securityfocus.com/bid/96692Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1037966Third Party Advisory, VDB Entry
• https://bugzilla.mozilla.org/show_bug.cgi?id=1284395Exploit, Issue Tracking, Patch, Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2017-05/Vendor Advisory
• http://www.securityfocus.com/bid/96692Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1037966Third Party Advisory, VDB Entry
• https://bugzilla.mozilla.org/show_bug.cgi?id=1284395Exploit, Issue Tracking, Patch, Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2017-05/Vendor Advisory

Published

Jun 11, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-5414The file picker dialog can choose and display the wrong loca…
• CVE-2017-5415An attack can use a blob URL and script to spoof an arbitrar…
• CVE-2017-5416In certain circumstances a networking event listener can be …
• CVE-2017-5417When dragging content from the primary browser pane to the a…
• CVE-2017-5418An out of bounds read error occurs when parsing some HTTP di…
• CVE-2017-5419If a malicious site repeatedly triggers a modal authenticati…
• CVE-2017-5421A malicious site could spoof the contents of the print previ…
• CVE-2017-5422If a malicious site uses the "view-source:" protocol in a se…
• CVE-2017-5425The Gecko Media Plugin sandbox allows access to local files …
• CVE-2017-5426On Linux, if the secure computing mode BPF (seccomp-bpf) fil…
• CVE-2017-5427A non-existent chrome.manifest file will attempt to be loade…
• CVE-2017-5428An integer overflow in "createImageBitmap()" was reported th…