CVE-2016-1955: Mozilla Firefox

Medium severity, CVSS 4.3. EPSS: 2% chance of exploitation in the next 30 days.

Mozilla Firefox before 45.0 allows remote attackers to bypass the Same Origin Policy and obtain sensitive information by reading a Content Security Policy (CSP) violation report that contains path information associated with an IFRAME element.

Affected products

• Mozilla Firefox: up to and including 44.0.2
• Novell Suse Package Hub For Suse Linux Enterprise: version 12 only
• Opensuse Leap: version 42.1 only
• Opensuse Opensuse: version 13.1 only; version 13.2 only

Published 2016-03-13. Last modified 2026-06-17.