CVE-2016-5282: Mozilla Firefox

Medium severity, CVSS 6.5. EPSS: 1.6% chance of exploitation in the next 30 days.

Mozilla Firefox before 49.0 does not properly restrict the scheme in favicon requests, which might allow remote attackers to obtain sensitive information via unspecified vectors, as demonstrated by a jar: URL for a favicon resource.

Affected products

• Mozilla Firefox: up to and including 48.0.2

Published 2016-09-22. Last modified 2026-06-17.