CVE-2016-9064

CVE-2016-9064 describes a vulnerability in Firefox ESR < 45.5 and Firefox < 50 where add-on updates failed to verify the add-on ID within a signed package. This allowed a man-in-the-middle attacker, capable of defeating certificate pinning, to deliver a malicious signed add-on instead of a legitimate update. The CVSSv3 score of 5.9 (Medium) indicates a network-based attack with high impact to integrity, but requiring high attack complexity. There is no evidence of active exploitation, public exploit code, or significant community discussion, with only one media article mentioning its fix in Firefox 50.