MediumPublic exploit

Privilege Escalation via Improper Access Control in Firefox (CVE-2015-0802)

IdentifiersCVE-2015-0802CWE-269

A critical vulnerability in Mozilla Firefox before version 37.0 allowed remote attackers to execute arbitrary JavaScript code with chrome privileges. The flaw was due to Firefox relying on docshell type information instead of page principal information for Window.webidl access control. This, combined with manipulation of JavaScript prototypes (e.g., setting document.proto to a Proxy object), enabled web content to influence privileged chrome:// code, leading to privilege escalation and potential remote code execution. The vulnerability was actively exploitable, as demonstrated by a working Metasploit module, and was fixed in Firefox 35 and later, as well as in ESR31 via specific patches.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation allowed remote attackers to escalate privileges from web content to execute arbitrary code with browser or system-level privileges. This could result in full compromise of the affected system if a user interacted with a malicious web page.

Mitigation

If you can’t patch tonight, do this now.

As an interim measure before patching, restrict access to untrusted web content and avoid interacting with suspicious web pages. Consider disabling JavaScript or using browser security extensions to limit exposure. However, full mitigation requires updating to a fixed version.

Remediation

Patch, then assume compromise.

Upgrade to Firefox 35 or later, or apply the relevant patches to ESR31 (bugs 1110614 and 1125015). Ensure that all systems are running a version of Firefox with the fix applied. Mozilla's security advisories provide further guidance on affected versions and patching.

PUBLIC EXPLOITS

Exploits

2 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos.

VALID 2 / 2 TOTALView more in app

firefox_proxy_prototype.rbMaturityWeaponizedFrameworkmetasploitVerified exploit

This repository contains a single Metasploit module: 'firefox_proxy_prototype.rb', which exploits privilege escalation vulnerabilities in Mozilla Firefox versions 31-34 (CVE-2014-8636, CVE-2015-0802). The exploit abuses a bug in the XPConnect component to gain a reference to the privileged chrome:// window, enabling remote code execution. The attack is delivered via a malicious web page that requires the victim to click anywhere on the page to trigger the vulnerability. The module supports both JavaScript-based and native payloads, targeting multiple platforms (Java, Linux, OSX, Solaris, Windows) through the Firefox browser. The exploit leverages browser-specific endpoints such as 'chrome://browser/content/browser.xul' and 'data:' URLs to achieve code execution. The repository is structured as a single Ruby file compatible with the Metasploit framework, and its primary purpose is to provide a working exploit for the referenced Firefox vulnerabilities.

Disclosed Jan 20, 2014rubyjavascriptbrowser

firefox_pdfjs_privilege_escalation.rbMaturityWeaponizedFrameworkmetasploitVerified exploit

This repository contains a single Metasploit module: 'firefox_pdfjs_privilege_escalation.rb', which exploits a privilege escalation vulnerability in Mozilla Firefox versions 35 and 36. The exploit leverages flaws in the handling of resource:// and chrome:// URIs in conjunction with PDF.js, allowing for privileged JavaScript injection. The module sets up a malicious web server that serves a crafted HTML/JavaScript payload. When a user with a vulnerable Firefox version visits the page and clicks anywhere, the exploit is triggered, resulting in remote code execution with the privileges of the browser process. The module supports customizable Metasploit payloads, enabling a range of post-exploitation actions. The code references two CVEs (CVE-2015-0816 and CVE-2015-0802) and targets Firefox on multiple platforms. The main attack vector is via the browser, specifically through user interaction with a malicious web page. Notable fingerprintable endpoints include the resource:// and chrome:// URI schemes and the use of data:application/pdf, to invoke PDF.js. The repository is operational and suitable for real-world exploitation in penetration testing scenarios.

Disclosed Mar 31, 2015rubyjavascriptbrowser

EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

CanonicalUbuntu Linuxoperating_system

MozillaFirefoxapplication

OpensuseOpensuseoperating_system

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

ACTIVITY FEED

Recent activity

1 sources tracked across advisories and community write-ups. News coverage will land here when it surfaces.

1 SOURCESView more in app

No news coverage yet. Advisories and community discussion only.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity