CVE-2014-8636
EXPLOITEDFirefox < 34.0.5 and SeaMonkey < 2.31 - Remote Code Execution via XrayWrapper DOM Interaction
Title source: llmExploitation Summary
CVE-2014-8636 has been observed exploited in the wild (reported by VulnCheck KEV). EIP tracks 1 public exploit from researchers including Metasploit.
AI-analyzed exploit summary This Metasploit module exploits a privilege escalation vulnerability in Firefox 31-34 by abusing a bug in the XPConnect component to gain a reference to the privileged chrome:// window, leading to remote code execution. The exploit requires user interaction (clicking on the page) to trigger the vulnerability.
Description
The XrayWrapper implementation in Mozilla Firefox before 35.0 and SeaMonkey before 2.32 does not properly interact with a DOM object that has a named getter, which might allow remote attackers to execute arbitrary JavaScript code with chrome privileges via unspecified vectors.
Exploits (1)
This Metasploit module exploits a privilege escalation vulnerability in Firefox 31-34 by abusing a bug in the XPConnect component to gain a reference to the privileged chrome:// window, leading to remote code execution. The exploit requires user interaction (clicking on the page) to trigger the vulnerability.