CVE-2017-7834: Mozilla Firefox

Medium severity, CVSS 6.1. EPSS: 1.5% chance of exploitation in the next 30 days.

A "data:" URL loaded in a new tab did not inherit the Content Security Policy (CSP) of the original page, allowing for bypasses of the policy including the execution of JavaScript. In prior versions when "data:" documents also inherited the context of the original page this would allow for potential cross-site scripting (XSS) attacks. This vulnerability affects Firefox < 57.

Affected products

• Mozilla Firefox: up to and including 56.0.2

Published 2018-06-11. Last modified 2026-06-17.