CVE-2017-5427

Severity: medium (CVSS 5.5 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2018-06-11 · updated 2026-06-17
Weakness: CWE-362

Description

A non-existent chrome.manifest file will attempt to be loaded during startup from the primary installation directory. If a malicious user with local access puts chrome.manifest and other referenced files in this directory, they will be loaded and activated during startup. This could result in malicious software being added without consent or modification of referenced installed files. This vulnerability affects Firefox < 52.

Affected products

Mozilla Firefox: before 52.0 — fixed in 52.0

How to fix

Upgrade to a fixed version: Mozilla Firefox 52.0. Check the vendor advisory for mitigations.

References

http://www.securityfocus.com/bid/96692
http://www.securitytracker.com/id/1037966
https://bugzilla.mozilla.org/show_bug.cgi?id=1295542
https://www.mozilla.org/security/advisories/mfsa2017-05/
http://www.securityfocus.com/bid/96692
http://www.securitytracker.com/id/1037966
https://bugzilla.mozilla.org/show_bug.cgi?id=1295542
https://www.mozilla.org/security/advisories/mfsa2017-05/

Get alerted when CVE-2017-5427 or the next vulnerability affects your stack