CVE-2017-7839: XSS
Control characters prepended before "javascript:" URLs pasted in the addressbar can cause the leading characters to be ignored and the pasted JavaScript to be executed instead of being blocked. This could be used in social engineering and self-cross-site-scripting (self-XSS) attacks where users are convinced to copy and paste text into the addressbar. This vulnerability affects Firefox < 57.
Other sources
Control characters prepended before javascript: URLs pasted in the addressbar can cause the leading characters to be ignored and the pasted JavaScript to be executed instead of being blocked. This could be used in social engineering and self-cross-site-scripting (self-XSS) attacks where users are convinced to copy and paste text into the addressbar.
Affected Software
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is CVE-2017-7839?
CVE-2017-7839 is a vulnerability in Mozilla Firefox that allows control characters prepended before "javascript:" URLs pasted in the address bar to be executed instead of being blocked.
How does CVE-2017-7839 affect users?
CVE-2017-7839 can be used in social engineering and self-cross-site-scripting (self-XSS) attacks where users are tricked into executing malicious JavaScript code.
What is the severity of CVE-2017-7839?
CVE-2017-7839 has a severity level of medium, with a CVSS score of 6.1.
How can users fix CVE-2017-7839?
Users can fix CVE-2017-7839 by updating Mozilla Firefox to version 57 or later.
Where can I find more information about CVE-2017-7839?
More information about CVE-2017-7839 can be found at the following references: [1] [2] [3]