Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
6.1

Firefox may run code in blocked iframe

CVE-2016-5262 · published 10 years ago
Summary

Versions of Firefox before 48 (and the extended support version before 45.3) can execute JavaScript placed in a MARQUEE tag even when the page is inside an iframe that is meant to block scripts. This mistake lets a malicious website run unwanted code in the browser, potentially stealing data or altering what the user sees. Upgrade Firefox to the latest version or apply the vendor's security update to stop this behavior.

What to do
  • Update debian firefox-esr to version 45.3.0esr-1.
Affected software
Ecosystem VendorProductAffected versions
Debian:12 debian firefox-esr < 45.3.0esr-1
Fix: upgrade to 45.3.0esr-1
Debian:13 debian firefox-esr < 45.3.0esr-1
Fix: upgrade to 45.3.0esr-1
Debian:14 debian firefox-esr < 45.3.0esr-1
Fix: upgrade to 45.3.0esr-1
– mozilla firefox <= 47.0.1
45.1.0
45.1.1
45.2.0
45.3.0
cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*
– oracle linux 5.0
6
7
cpe:2.3:o:oracle:linux:5.0:*:*:*:*:*:*:*
Original advisory text
Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 process JavaScript event-handler attributes of a MARQUEE element within a sandboxed IFRAME element that lacks the sandbox="allow-scripts...
Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 process JavaScript event-handler attributes of a MARQUEE element within a sandboxed IFRAME element that lacks the sandbox="allow-scripts" attribute value, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via a crafted web site.
References
Severity
6.1 Medium
Exploitation
1% chance of attack within 30 days
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published5 Aug 2016
Updated31 Oct 2026
First seen22 Sep 2026
Sources
DEBIAN-CVE-2016-5262 · OSV
CVE-2016-5262 · NVD
Track software like this
Free during beta