CVE-2016-1949: Mozilla Firefox

High severity, CVSS 8.8. EPSS: 1.5% chance of exploitation in the next 30 days.

Mozilla Firefox before 44.0.2 does not properly restrict the interaction between Service Workers and plugins, which allows remote attackers to bypass the Same Origin Policy via a crafted web site that triggers spoofed responses to requests that use NPAPI, as demonstrated by a request for a crossdomain.xml file.

Affected products

• Mozilla Firefox: up to and including 44.0.1

Published 2016-02-13. Last modified 2026-06-17.