Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2014-1527: Firefox for Android can display fake web address

CVE-2014-1527 · published 12 years ago

Summary

The Android version of Firefox (versions before 29) can be tricked by a malicious web page to hide the real address bar and show a fake one. This could make users think they are on a trusted site when they are not. Update Firefox to the latest version to prevent this.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
fedoraproject	fedora	19 `cpe:2.3:o:fedoraproject:fedora:19:::::::*`
mozilla	firefox	<= 28.0 0.1 0.2 0.3 0.4 0.5 0.6 0.6.1 0.7 0.7.1 0.8 0.9 188 more version ranges `cpe:2.3:a:mozilla:firefox::::::::`
oracle	solaris	11.3 `cpe:2.3:o:oracle:solaris:11.3:::::::*`

Original advisory text

Mozilla Firefox before 29.0 on Android allows remote attackers to spoof the address bar via crafted JavaScript code that uses DOM events to prevent the reemergence of the actual address bar after s...

References

http://lists.fedoraproject.org/pipermail/package-announce/2014-May/132437.html Third Party Advisory
http://www.mozilla.org/security/announce/2014/mfsa2014-40.html Vendor Advisory
http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html Third Party Advisory
http://www.securitytracker.com/id/1030163 Third Party Advisory VDB Entry
https://bugzilla.mozilla.org/show_bug.cgi?id=960146 Issue Tracking

Fix within

Internet-facing 14 days

Internal 60 days

Not known to be exploited
Can be exploited automatically (estimated)
Gives an attacker partial control (estimated)

Severity

5.0 Medium

Exploitation

1% chance of attack within 30 days

Timeline

Published30 Apr 2014

Updated31 Oct 2026

First seen29 Sep 2026

Sources

CVE-2014-1527 · NVD

Track software like this

Free during beta