CVE-2016-5283: Mozilla Firefox

High severity, CVSS 8.8. EPSS: 1.5% chance of exploitation in the next 30 days.

Mozilla Firefox before 49.0 allows remote attackers to bypass the Same Origin Policy via a crafted fragment identifier in the SRC attribute of an IFRAME element, leading to insufficient restrictions on link-color information after a document is resized.

Affected products

• Mozilla Firefox: up to and including 48.0.2

Published 2016-09-22. Last modified 2026-06-17.