CVE-2015-0816
Firefox < 37.0 and ESR 31.x < 31.6 - Remote Code Execution via resource: URL Bypass
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2015-0816. PoCs published by Metasploit.
AI-analyzed exploit summary This Metasploit module exploits a privilege escalation vulnerability in Firefox 35-36 by abusing resource:// URIs and PDF.js to inject privileged JavaScript, leading to remote code execution. The exploit requires user interaction (clicking on the page) to trigger the vulnerability.
Description
Mozilla Firefox before 37.0, Firefox ESR 31.x before 31.6, and Thunderbird before 31.6 do not properly restrict resource: URLs, which makes it easier for remote attackers to execute arbitrary JavaScript code with chrome privileges by leveraging the ability to bypass the Same Origin Policy, as demonstrated by the resource: URL associated with PDF.js.
Exploits (1)
This Metasploit module exploits a privilege escalation vulnerability in Firefox 35-36 by abusing resource:// URIs and PDF.js to inject privileged JavaScript, leading to remote code execution. The exploit requires user interaction (clicking on the page) to trigger the vulnerability.