vulnerability

MFSA2016-80 Firefox: Same-origin policy violation using local HTML file and saved shortcut file (CVE-2016-5265)

Try Surface Command

Back to search

Severity

CVSS

(AV:N/AC:H/Au:N/C:P/I:P/A:N)

Published

Aug 2, 2016

Added

Aug 3, 2016

Modified

Mar 27, 2026

Description

Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 allow user-assisted remote attackers to bypass the Same Origin Policy, and conduct Universal XSS (UXSS) attacks or read arbitrary files, by arranging for the presence of a crafted HTML document and a crafted shortcut file in the same local directory.

Solutions

mozilla-firefox-esr-upgrade-45_3mozilla-firefox-upgrade-48_0

References

CVE-2016-5265
https://attackerkb.com/topics/CVE-2016-5265
CWE-200
CWE-79
EUVD-EUVD-2016-6216
http://www.mozilla.org/security/announce/2016/mfsa2016-80.html
https://euvd.enisa.europa.eu/vulnerability/EUVD-2016-6216

Rapid7 Labs

2026 Global Threat Landscape Report

The predictive window has collapsed. Exploitation follows disclosure in days. See how attackers are accelerating and how to stay ahead.

Get report