CVE-2016-5282

—

CVSS 3.0

6.5 medium

EPSS

2%p75

Published

Sep 22, 2016 (Sep 22, 2016)

Modified

Jun 17, 2026

Description

Mozilla Firefox before 49.0 does not properly restrict the scheme in favicon requests, which might allow remote attackers to obtain sensitive information via unspecified vectors, as demonstrated by a jar: URL for a favicon resource.

Vendors: mozilla
Products: firefox
Weakness: CWE-200
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

NVD CVE.org GitHub PoCs EPSS (1.6%)

In the news0 stories

No ingested article mentions this CVE yet.