CVE-2016-9904: Infoleak
An attacker could use a JavaScript Map/Set timing attack to determine whether an atom is used by another compartment/zone in specific contexts. This could be used to leak information, such as usernames embedded in JavaScript code, across websites.
Affected Software
Remediation
Patch Available
Event History
Parent advisories
This vulnerability appears in the following advisories.
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2016-9904?
The severity of CVE-2016-9904 has been classified as high due to its potential to leak sensitive user information across websites.
How do I fix CVE-2016-9904?
To fix CVE-2016-9904, ensure that you are using an updated version of the affected software, such as Firefox 118.0.2-1 or newer.
Which software is affected by CVE-2016-9904?
Affected software includes Mozilla Firefox, Firefox ESR, and Thunderbird versions below the specified remedial versions.
What kind of attack does CVE-2016-9904 enable?
CVE-2016-9904 enables JavaScript timing attacks that could be exploited to gather sensitive information from users.
Can CVE-2016-9904 affect users on multiple websites?
Yes, CVE-2016-9904 can potentially leak information like usernames across different websites by exploiting timing differences.