CVE-2017-5451

A mechanism to spoof the addressbar through the user interaction on the addressbar and the "onblur" event. The event could be used by script to affect text display to make the loaded site appear to be different from the one actually loaded within the addressbar. This vulnerability affects Thunderbird < 52.1, Firefox ESR < 52.1, and Firefox < 53.

• CWE-20

• http://www.securityfocus.com/bid/97940Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1038320Third Party Advisory, VDB Entry
• https://access.redhat.com/errata/RHSA-2017:1106Third Party Advisory
• https://access.redhat.com/errata/RHSA-2017:1201Third Party Advisory
• https://bugzilla.mozilla.org/show_bug.cgi?id=1273537Exploit, Issue Tracking, Patch, Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2017-10/Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2017-12/Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2017-13/Vendor Advisory
• http://www.securityfocus.com/bid/97940Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1038320Third Party Advisory, VDB Entry
• https://access.redhat.com/errata/RHSA-2017:1106Third Party Advisory
• https://access.redhat.com/errata/RHSA-2017:1201Third Party Advisory
• https://bugzilla.mozilla.org/show_bug.cgi?id=1273537Exploit, Issue Tracking, Patch, Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2017-10/Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2017-12/Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2017-13/Vendor Advisory

Published

Jun 11, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-5445A vulnerability while parsing "application/http-index-format…
• CVE-2017-5446An out-of-bounds read when an HTTP/2 connection to a servers…
• CVE-2017-5447An out-of-bounds read during the processing of glyph widths …
• CVE-2017-5448An out-of-bounds write in "ClearKeyDecryptor" while decrypti…
• CVE-2017-5449A possibly exploitable crash triggered during layout and man…
• CVE-2017-5450A mechanism to spoof the Firefox for Android addressbar usin…
• CVE-2017-5452Malicious sites can display a spoofed addressbar on a page w…
• CVE-2017-5453A mechanism to inject static HTML into the RSS reader previe…
• CVE-2017-5454A mechanism to bypass file system access protections in the …
• CVE-2017-5455The internal feed reader APIs that crossed the sandbox barri…
• CVE-2017-5456A mechanism to bypass file system access protections in the …
• CVE-2017-5458When a "javascript:" URL is drag and dropped by a user into …