CWE Code: 264
Vulnerability Type: privilege_escalation
CVSS Score: 5.0
CWE Name:  Permissions Privileges and Access Controls
Summary: mozilla firefox before 37.0, firefox esr 31.x before 31.6, and thunderbird before 31.6 do not properly restrict resource: urls, which makes it easier for remote attackers to execute arbitrary javascript code with chrome privileges by leveraging the ability to bypass the same origin policy, as demonstrated by the resource: url associated with pdf.js.
Access Authentication: NONE
Access Complexity: LOW
Access Vector: NETWORK
Impact (C/I/A): NONE/PARTIAL/NONE
Published Date: 2015-04-01
Last Modified Date: 2017-09-17