CVE-2017-7820: Medium severity firefox vulnerability
Last updated 24 July 2024
Other sources
The "instanceof" operator can bypass the Xray wrapper mechanism. When called on web content from the browser itself or an extension the web content can provide its own result for that operator, possibly tricking the browser or extension into mishandling the element. This vulnerability affects Firefox < 56.
— Launchpad
The instanceof operator can bypass the Xray wrapper mechanism. When called on web content from the browser itself or an extension the web content can provide its own result for that operator, possibly tricking the browser or extension into mishandling the element.
Affected Software
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2017-7820.
Which software is affected by this vulnerability?
This vulnerability affects Mozilla Firefox versions up to and including 56.0.3.
What is the severity of CVE-2017-7820?
The severity of CVE-2017-7820 is medium, with a CVSS score of 5.3.
How can this vulnerability be exploited?
This vulnerability can be exploited by using the instanceof operator on web content from the browser itself or an extension, tricking the browser or extension into mishandling the element.
Is there a fix available for this vulnerability?
Yes, the vulnerability can be fixed by updating Mozilla Firefox to version 56.0.3 or newer.