CVE-2017-7839

Control characters prepended before "javascript:" URLs pasted in the addressbar can cause the leading characters to be ignored and the pasted JavaScript to be executed instead of being blocked. This could be used in social engineering and self-cross-site-scripting (self-XSS) attacks where users are convinced to copy and paste text into the addressbar. This vulnerability affects Firefox < 57.

• CWE-79

• http://www.securityfocus.com/bid/101832Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1039803Third Party Advisory, VDB Entry
• https://bugzilla.mozilla.org/show_bug.cgi?id=1402896Issue Tracking, Permissions Required
• https://www.mozilla.org/security/advisories/mfsa2017-24/Vendor Advisory
• http://www.securityfocus.com/bid/101832Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1039803Third Party Advisory, VDB Entry
• https://bugzilla.mozilla.org/show_bug.cgi?id=1402896Issue Tracking, Permissions Required
• https://www.mozilla.org/security/advisories/mfsa2017-24/Vendor Advisory

Published

Jun 11, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-7833Some Arabic and Indic vowel marker characters can be combine…
• CVE-2017-7834A "data:" URL loaded in a new tab did not inherit the Conten…
• CVE-2017-7835Mixed content blocking of insecure (HTTP) sub-resources in a…
• CVE-2017-7836The "pingsender" executable used by the Firefox Health Repor…
• CVE-2017-7837SVG loaded through "<img>" tags can use "<meta>" tags within…
• CVE-2017-7838Punycode format text will be displayed for entire qualified …
• CVE-2017-7840JavaScript can be injected into an exported bookmarks file b…
• CVE-2017-7842If a document's Referrer Policy attribute is set to "no-refe…
• CVE-2017-7843When Private Browsing mode is used, it is possible for a web…
• CVE-2017-7844A combination of an external SVG image referenced on a page …
• CVE-2017-7845A buffer overflow occurs when drawing and validating element…
• CVE-2017-7846It is possible to execute JavaScript in the parsed RSS feed …