CVE-2006-1650: Mozilla Firefox

Medium severity, CVSS 5.0. EPSS: 1.2% chance of exploitation in the next 30 days.

Firefox 1.5.0.1 allows remote attackers to spoof the address bar and possibly conduct phishing attacks by re-opening the window to a malicious Shockwave Flash application, then changing the window location back to a trusted URL while the Flash application is still loading. NOTE: a followup was unable to replicate this issue.

Affected products

• Mozilla Firefox: version 1.5.0.1 only

Published 2006-04-06. Last modified 2026-06-16.