ZeroDay Findings
Sign inSign up

Findings

CVE-2015-4495

Mozilla Firefox Security Feature Bypass Vulnerability

Published Aug 7, 2015 · updated Jun 16, 2026 · mozilla firefox

The PDF reader in Mozilla Firefox before 39.0.3, Firefox ESR 38.x before 38.1.1, and Firefox OS before 2.2 allows remote attackers to bypass the Same Origin Policy, and read arbitrary files or gain privileges, via vectors involving crafted JavaScript code and a native setter, as exploited in the wild in August 2015.

Timeline

Detection, updates, and resolution for this record.

  1. Aug 7, 2015 · Catalog

    Detected

    The PDF reader in Mozilla Firefox before 39.0.3, Firefox ESR 38.x before 38.1.1, and Firefox OS before 2.2 allows remote attackers to bypass the Same Origin Policy, and read arbitrary files or gain privileges, via vectors involving crafted JavaScript code and a native setter, as exploited in the wild in August 2015.

  2. May 25, 2022 · CISA KEV

    Known exploited

    Apply updates per vendor instructions.

  3. Jun 15, 2022 · CISA KEV

    Remediation due

    Apply updates per vendor instructions.

  4. Jun 16, 2026 · Catalog

    Updated

    The PDF reader in Mozilla Firefox before 39.0.3, Firefox ESR 38.x before 38.1.1, and Firefox OS before 2.2 allows remote attackers to bypass the Same Origin Policy, and read arbitrary files or gain privileges, via vectors involving crafted JavaScript code and a native setter, as exploited in the wild in August 2015.

Required action

Apply updates per vendor instructions.

CISA due date Jun 15, 2022

Affected

  • cpe canonical/ubuntu linux12.04
  • cpe canonical/ubuntu linux14.04
  • cpe canonical/ubuntu linux15.04
  • cpe mozilla/firefoxversion unspecified
  • cpe mozilla/firefox osversion unspecified
  • cpe oracle/solaris11.3
  • cpe redhat/enterprise linux desktop5.0
  • cpe suse/linux enterprise debuginfo11
  • vendor Mozilla Firefoxversion unspecified

Sources

  • CISA KEVCVE-2015-4495

    Moxilla Firefox allows remote attackers to bypass the Same Origin Policy to read arbitrary files or gain privileges.

    cisa.gov
  • CVE.orgCVE-2015-4495

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2015-4495

    30-day exploitation probability 68.6%

    first.org
  • Exploit Database37772

    Public archive entry. The exploit body is not stored here.

    exploit-db.com
  • Metasploit Modulesauxiliary_gather/firefox_pdfjs_file_theft

    Public module reference (normal). Module source is not copied into this catalog.

    rapid7.com
  • NIST NVDCVE-2015-4495

    The PDF reader in Mozilla Firefox before 39.0.3, Firefox ESR 38.x before 38.1.1, and Firefox OS before 2.2 allows remote attackers to bypass the Same Origin Policy, and read arbitrary files or gain privileges, via vectors involving crafted JavaScript code and a native setter, as

    nvd.nist.gov

References