Mozilla Firefox before 37.0 relies on docshell type information instead of page principal information for Window.webidl access control, whi…

published 2015-04-01 11 y ago modified 2026-06-17 4 mo ago also EUVD-2015-0815

cvss: 5.0; version 2.0, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 65.9%; EPSS 65.9% chance of exploitation in 30 days, percentile 99.2%
public exploits: 3; Metasploit, Exploit-DB

Mozilla Firefox before 37.0 relies on docshell type information instead of page principal information for Window.webidl access control, which might allow remote attackers to execute arbitrary JavaScript code with chrome privileges via certain content navigation that leverages the reachability of a privileged window with an unintended persistence of access to restricted internal methods.

Patch / fix

distros 2

ubuntu opensuse

firefox Ubuntu 14.04 LTS 37.0+build2-0ubuntu0.14.04.1

ubuntu advisories UBUNTU-CVE-2015-0802

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

firefox-esr openSUSE Tumbleweed 128.5.1-1.1
MozillaFirefox openSUSE Tumbleweed 50.1.0-1.1

opensuse advisories openSUSE-SU-2024:14572-1 openSUSE-SU-2024:10071-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2015-0802 updated 2026-11-05 cvss 4.3

Mozilla: Windows can retain access to privileged content on navigation to unprivileged pages (MFSA 2015-42)

Red Hat Enterprise Linux 5 firefox, thunderbird Red Hat Enterprise Linux 6 firefox, thunderbird Red Hat Enterprise Linux 7 firefox, thunderbird
not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Timeline

2014-01-20 First public exploit (Metasploit exploit/multi/browser/firefox_proxy_prototype)
2015-04-01 Published

Exploit prediction

65.87% chance of exploitation in the next 30 days, higher than 99.2% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

Metasploit exploit/multi/browser/firefox_pdfjs_privilege_escalation Firefox PDF.js Privileged Javascript Injection metasploit exploit, manual rank, 2015-03-31
Metasploit exploit/multi/browser/firefox_proxy_prototype Firefox Proxy Prototype Privileged Javascript Injection metasploit exploit, manual rank, 2014-01-20
EDB-37958 Mozilla Firefox - 'pdf.js' Privileged JavaScript Injection (Metasploit) remote, 2015-08-24

CVSS scores

assigned by	version	score	vector
NVD	2.0	5.0	AV:N/AC:L/Au:N/C:N/I:P/A:N

Classification

Weakness

CWE-264 Permissions, Privileges, and Access Controls

References

exploit-db.com /exploits/37958/
exploit
security.gentoo.org /glsa/201512-10
vendor-advisory
ubuntu.com /usn/USN-2550-1
vendor-advisory
lists.opensuse.org /opensuse-security-announce/2015-04/msg00003.html
vendor-advisory
mozilla.org /security/announce/2015/mfsa2015-42.html
vendor-advisory
bugzilla.mozilla.org /show_bug.cgi?id=1124898
securitytracker.com /id/1031996
vdb-entry
oracle.com /technetwork/topics/security/bulletinapr2016-2952098.html

Sources

CVE List CVE-2015-0802
NVD CVE-2015-0802

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary