CVE-2006-6077: Mozilla Firefox

Medium severity, CVSS 5.0. EPSS: 2% chance of exploitation in the next 30 days.

The (1) Password Manager in Mozilla Firefox 2.0, and 1.5.0.8 and earlier; and the (2) Passcard Manager in Netscape 8.1.2 and possibly other versions, do not properly verify that an ACTION URL in a FORM element containing a password INPUT element matches the web site for which the user stored a password, which allows remote attackers to obtain passwords via a password INPUT element on a different web page located on the web site intended for this password.

Affected products

• Mozilla Firefox: up to and including 1.5.0.8; version 1.5 only; version 1.5.0.1 only; version 1.5.0.2 only; version 1.5.0.3 only; version 1.5.0.4 only; …
• Netscape Navigator: version 8.1.2 only

Published 2006-11-24. Last modified 2026-06-16.