Vulnerability record · CVE-2015-0802 · published 1 April 2015
CVE-2015-0802: Firefox docshell access control flaw allows chrome-privileged JavaScript execution
Opensuse · Opensuse
Mozilla Firefox before 37.0 used docshell type information rather than page principal information for Window.webidl access control. This could let a privileged window remain reachable with unintended persistence of access to restricted internal methods. A remote attacker could then execute arbitrary JavaScript with chrome privileges.
Description
Mozilla Firefox before 37.0 relies on docshell type information instead of page principal information for Window.webidl access control, which might allow remote attackers to execute arbitrary JavaScript code with chrome privileges via certain content navigation that leverages the reachability of a privileged window with an unintended persistence of access to restricted internal methods.
AV:N/AC:L/Au:N/C:N/I:P/A:N
Automated analysis
high priorityPublic exploit code exists and EPSS is very high, but the CVSS impact is limited to integrity with no confidentiality or availability impact.
What it is
Mozilla Firefox before 37.0 used docshell type information rather than page principal information for Window.webidl access control. This could let a privileged window remain reachable with unintended persistence of access to restricted internal methods. A remote attacker could then execute arbitrary JavaScript with chrome privileges.
Impact
An attacker can run JavaScript with chrome privileges, escaping the browser's normal web content sandbox. That level of access can compromise the browser process and the user's data.
Attack surface
Reached remotely over the network via crafted content navigation in Firefox; the CVSS vector shows no authentication and no user interaction required. The flaw is in how Firefox resolves Window.webidl access control during navigation.
Exploitation
Not listed in CISA KEV, but EPSS is high at 0.67268 (99.268th percentile) and an Exploit-DB entry (37958) exists, indicating public exploit material is available.
What to do
- Upgrade Firefox to 37.0 or later, or apply the vendor update for your distribution (Mozilla MFSA 2015-42, Ubuntu USN-2550-1, openSUSE, Gentoo GLSA 201512-10).
- If immediate upgrade is not possible, restrict browsing to trusted sites and consider disabling or isolating the affected Firefox version.
- Track the Mozilla advisory and distribution advisories for any backported fixes.
- Verify installed Firefox version across managed endpoints and enforce a minimum version of 37.0.
Detection
- Monitor for Firefox versions below 37.0 on endpoints and flag them for upgrade.
- Review browser crash or exploit telemetry for unusual chrome-privileged JavaScript execution or navigation anomalies.
- Check proxy or network logs for known exploit delivery patterns tied to this CVE where feasible.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
3 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2015-0802 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2015-0802), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
