CVE-2016-2821 is a use-after-free vulnerability in the mozilla::dom::Element class affecting Mozilla Firefox before version 47.0 and Firefox ESR 45.x before 45.2. This flaw occurs when contenteditable mode is enabled, allowing remote attackers to trigger deletion of DOM elements created in the editor. With a CVSSv3 score of 7.5 (HIGH), successful exploitation could lead to arbitrary code execution or a denial of service due to heap memory corruption, requiring user interaction. There is no evidence of active exploitation, nor are there publicly available exploit modules in Metasploit or Nuclei, or entries in ExploitDB. While there is some community discussion and media coverage, it is not listed on the CISA KEV catalog.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 46.0.1CPE matchmatch criteria | cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:* | ||
45.1.0CPE matchmatch criteria | cpe:2.3:a:mozilla:firefox:45.1.0:*:*:*:*:*:*:* | ||
45.1.1CPE matchmatch criteria | cpe:2.3:a:mozilla:firefox:45.1.1:*:*:*:*:*:*:* | ||
8.0CPE matchmatch criteria | cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* | ||
42.1CPE matchmatch criteria | cpe:2.3:o:opensuse:leap:42.1:*:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.4 Bluesky, 0.2 Mastodon, and 0.1 GitHub mentions.
The average CVE in this peer group has 0.6 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.