CVE-2016-9061 describes a high-severity vulnerability in Firefox for Android versions prior to 50, where a pre-installed malicious Android application could exploit signature-level permissions to access API keys intended solely for Firefox. The CVSS score of 7.5 indicates a high impact, as an attacker could remotely access sensitive information without user interaction or complex conditions. While there is no evidence of active exploitation, public exploit code, or KEV listing, the vulnerability has received some community discussion and media coverage.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 50.0CPE matchmatch criteria | cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:* | ||
< 50CPE match | cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.