vulnerability

MFSA2016-48 Firefox: Firefox Health Reports could accept events from untrusted domains (CVE-2016-2820)

Try Surface Command

Back to search

Severity

CVSS

(AV:N/AC:M/Au:N/C:N/I:P/A:N)

Published

Apr 26, 2016

Added

Apr 27, 2016

Modified

Mar 27, 2026

Description

The Firefox Health Reports (aka FHR or about:healthreport) feature in Mozilla Firefox before 46.0 does not properly restrict the origin of events, which makes it easier for remote attackers to modify sharing preferences by leveraging access to the remote-report IFRAME element.

Solution

mozilla-firefox-upgrade-46_0

References

CVE-2016-2820
https://attackerkb.com/topics/CVE-2016-2820
CWE-284
EUVD-EUVD-2016-3893
http://www.mozilla.org/security/announce/2016/mfsa2016-48.html
https://euvd.enisa.europa.eu/vulnerability/EUVD-2016-3893

Rapid7 Labs

2026 Global Threat Landscape Report

The predictive window has collapsed. Exploitation follows disclosure in days. See how attackers are accelerating and how to stay ahead.

Get report