Vulnerability Details : CVE-2014-8636

The XrayWrapper implementation in Mozilla Firefox before 35.0 and SeaMonkey before 2.32 does not properly interact with a DOM object that has a named getter, which might allow remote attackers to execute arbitrary JavaScript code with chrome privileges via unspecified vectors.
Published 2015-01-14 11:59:06
Updated 2017-09-08 01:29:26
Source Mozilla Corporation
View at NVD,   CVE.org
At least one public exploit which can be used to exploit this vulnerability exists!

Exploit prediction scoring system (EPSS) score for CVE-2014-8636

Probability of exploitation activity in the next 30 days: 94.15%

Percentile, the proportion of vulnerabilities that are scored at or less: ~ 99 % EPSS Score History EPSS FAQ

Metasploit modules for CVE-2014-8636

  • Firefox Proxy Prototype Privileged Javascript Injection
    Disclosure Date: 2014-01-20
    First seen: 2020-04-26
    exploit/multi/browser/firefox_proxy_prototype
    This exploit gains remote code execution on Firefox 31-34 by abusing a bug in the XPConnect component and gaining a reference to the privileged chrome:// window. This exploit requires the user to click anywhere on the page to trigger the vulnerability. Authors: - jo

CVSS scores for CVE-2014-8636

Base Score Base Severity CVSS Vector Exploitability Score Impact Score Source
7.5
 HIGH AV:N/AC:L/Au:N/C:P/I:P/A:P
10.0
6.4
 nvd@nist.gov

CWE ids for CVE-2014-8636

  • The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
    Assigned by: nvd@nist.gov (Primary)

References for CVE-2014-8636

Products affected by CVE-2014-8636

This web site uses cookies for managing your session, storing preferences, website analytics and additional purposes described in our privacy policy.
By using this web site you are agreeing to CVEdetails.com terms of use!
Accept Close