CVE-2017-7820
Last modified
CVE-2017-7820 is a vulnerability of currently unknown severity. The "instanceof" operator can bypass the Xray wrapper mechanism. When called on web content from the browser itself or an extension the web content can provide its own result for that operator, possibly tricking the browser or extension into mishandling the element. EPSS estimates a 1.19% chance of exploitation in the next 30 days.
Description
The "instanceof" operator can bypass the Xray wrapper mechanism. When called on web content from the browser itself or an extension the web content can provide its own result for that operator, possibly tricking the browser or extension into mishandling the element. This vulnerability affects Firefox < 56.
Metrics
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Mozilla | Firefox | <= 55.0.3 |
References
- http://www.securityfocus.com/bid/101057Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1039465Third Party Advisory, VDB Entry
- https://bugzilla.mozilla.org/show_bug.cgi?id=1378207Exploit, Issue Tracking
- https://www.mozilla.org/security/advisories/mfsa2017-21/Vendor Advisory
- http://www.securityfocus.com/bid/101057Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1039465Third Party Advisory, VDB Entry
- https://bugzilla.mozilla.org/show_bug.cgi?id=1378207Exploit, Issue Tracking
- https://www.mozilla.org/security/advisories/mfsa2017-21/Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2017-7820?
How severe is CVE-2017-7820?
How do I fix CVE-2017-7820?
Are you affected by CVE-2017-7820?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST