Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.3
CVE-2017-5463: Firefox Android may display fake address bar URL
CVE-2017-5463 · published 8 years ago
Summary
A specially crafted Android link can open Firefox for Android in reader mode and show a URL that the user did not actually visit. This can trick users into thinking they are on a trusted site while they are not. Updating Firefox to version 53 or later resolves the issue.
What to do
- Update mozilla firefox to version 53.0 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| mozilla | firefox |
< 53.0 cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:* |
Original advisory text
Android intents can be used to launch Firefox for Android in reader mode with a user specified URL. This allows an attacker to spoof the contents of the addressbar as displayed to users. Note: This...
Android intents can be used to launch Firefox for Android in reader mode with a user specified URL. This allows an attacker to spoof the contents of the addressbar as displayed to users. Note: This attack only affects Firefox for Android. Other operating systems are not affected. This vulnerability affects Firefox < 53.
References
- http://www.securityfocus.com/bid/97940 Third Party Advisory VDB Entry
- http://www.securitytracker.com/id/1038320 Third Party Advisory VDB Entry
- https://bugzilla.mozilla.org/show_bug.cgi?id=1338867 Issue Tracking Patch Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2017-10/ Vendor Advisory
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker partial control (estimated)
Type
CWE-20Improper Input Validation
Timeline
Published11 Jun 2018
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2017-5463 · NVD
Track software like this
Free during beta