CVE-2015-4476: Mozilla Firefox

Medium severity, CVSS 4.3. EPSS: 1.8% chance of exploitation in the next 30 days.

Mozilla Firefox before 41.0 on Android allows user-assisted remote attackers to spoof address-bar attributes by leveraging lack of navigation after a paste of a URL with a nonstandard scheme, as demonstrated by spoofing an SSL attribute.

Affected products

• Mozilla Firefox: up to and including 40.0.3

Published 2015-09-24. Last modified 2026-06-17.