CVE-2014-1583: Mozilla Firefox

Medium severity, CVSS 5.0. EPSS: 2.9% chance of exploitation in the next 30 days.

The Alarm API in Mozilla Firefox before 33.0 and Firefox ESR 31.x before 31.2 does not properly restrict toJSON calls, which allows remote attackers to bypass the Same Origin Policy via crafted API calls that access sensitive information within the JSON data of an alarm.

Affected products

• Mozilla Firefox: up to and including 32.0; version 30.0 only; version 31.0 only; version 31.1.0 only

Published 2014-10-15. Last modified 2026-06-17.