Every CVE Search/ Get API key

CVE-2017-7762

When entered directly, Reader Mode did not strip the username and password section of URLs...

7.5 HighFix available

When entered directly, Reader Mode did not strip the username and password section of URLs displayed in the addressbar. This can be used for spoofing the domain of the current page. This vulnerability affects Firefox < 54.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
High
Availability
None

Exploit likelihood

1.88%Up 0.4 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 7.5

When entered directly, Reader Mode did not strip the username and password section of URLs displayed in the addressbar. This can be used for spoofing the domain of the current page. This vulnerability affects Firefox < 54.

Record
CVE-2017-7762
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS 2.0
5.0 MediumAV:N/AC:L/Au:N/C:N/I:P/A:N
Weakness
CWE-20
Updated
2026-11-02
CVE List No score

When entered directly, Reader Mode did not strip the username and password section of URLs displayed in the addressbar. This can be used for spoofing the domain of the current page. This vulnerability affects Firefox < 54.

Record
CVE-2017-7762
Updated
2026-11-02
EUVDEUVD-2017-16737 No score

When entered directly, Reader Mode did not strip the username and password section of URLs displayed in the addressbar. This can be used for spoofing the domain of the current page. This vulnerability affects Firefox < 54.

Record
EUVD-2017-16737
Updated
2026-11-03
GitHub AdvisoriesGHSA-7g8j-7wv5-6f7h 7.5

When entered directly, Reader Mode did not strip the username and password section of URLs...

When entered directly, Reader Mode did not strip the username and password section of URLs displayed in the addressbar. This can be used for spoofing the domain of the current page. This vulnerability affects Firefox < 54.

Record
GHSA-7g8j-7wv5-6f7h
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weakness
CWE-20
Updated
2026-11-02
OSVRHSA-2018:2112 9.8

Red Hat Security Advisory: firefox security update

Record
RHSA-2018:2112
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2018:2113 9.8

Red Hat Security Advisory: firefox security update

Record
RHSA-2018:2113
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2017-7762 7.5

When entered directly, Reader Mode did not strip the username and password section of URLs displayed in the addressbar. This can be used for spoofing the domain of the current page. This vulnerability affects Firefox < 54.

Record
UBUNTU-CVE-2017-7762
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02
OSVUSN-3315-1 No score

firefox vulnerabilities

Multiple security issues were discovered in Firefox. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service, read uninitialized memory, obtain sensitive information, spoof the addressbar contents, or execute arbitrary code. (CVE-2017-5470, CVE-2017-5471, CVE-2017-5472, CVE-2017-7749, CVE-2017-7750, CVE-2017-7751, CVE-2017-7752, CVE-2017-7754, CVE-2017-7756, CVE-2017-7757, CVE-2017-7758, CVE-2017-7762, CVE-2017-7764)

Multiple security issues were discovered in the Graphite 2 library used by Firefox. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service, read uninitialized memory, or execute arbitrary code. (CVE-2017-7771, CVE-2017-7772, CVE-2017-7773, CVE-2017-7774, CVE-2017-7775, CVE-2017-7776, CVE-2017-7777, CVE-2017-7778)

Record
USN-3315-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
firefox
Red Hat:enterprise_linux:6::client
From an advisory covering 11 CVEs
 before 0:60.1.0-5.el6
0:60.1.0-5.el6
firefox-debuginfo
Red Hat:enterprise_linux:6::client
From an advisory covering 11 CVEs
 before 0:60.1.0-5.el6
0:60.1.0-5.el6
firefox
Red Hat:enterprise_linux:6::computenode
From an advisory covering 11 CVEs
 before 0:60.1.0-5.el6
0:60.1.0-5.el6
firefox-debuginfo
Red Hat:enterprise_linux:6::computenode
From an advisory covering 11 CVEs
 before 0:60.1.0-5.el6
0:60.1.0-5.el6
firefox
Red Hat:enterprise_linux:6::server
From an advisory covering 11 CVEs
 before 0:60.1.0-5.el6
0:60.1.0-5.el6
firefox-debuginfo
Red Hat:enterprise_linux:6::server
From an advisory covering 11 CVEs
 before 0:60.1.0-5.el6
0:60.1.0-5.el6
firefox
Red Hat:enterprise_linux:6::workstation
From an advisory covering 11 CVEs
 before 0:60.1.0-5.el6
0:60.1.0-5.el6
firefox-debuginfo
Red Hat:enterprise_linux:6::workstation
From an advisory covering 11 CVEs
 before 0:60.1.0-5.el6
0:60.1.0-5.el6
firefox
Red Hat:enterprise_linux:7::client
From an advisory covering 11 CVEs
 before 0:60.1.0-4.el7_5
0:60.1.0-4.el7_5
firefox-debuginfo
Red Hat:enterprise_linux:7::client
From an advisory covering 11 CVEs
 before 0:60.1.0-4.el7_5
0:60.1.0-4.el7_5
Show 8 moreShow less
Affected packages
PackageAffectedFixed
firefox
Red Hat:enterprise_linux:7::server
From an advisory covering 11 CVEs
 before 0:60.1.0-4.el7_5
0:60.1.0-4.el7_5
firefox-debuginfo
Red Hat:enterprise_linux:7::server
From an advisory covering 11 CVEs
 before 0:60.1.0-4.el7_5
0:60.1.0-4.el7_5
firefox
Red Hat:enterprise_linux:7::workstation
From an advisory covering 11 CVEs
 before 0:60.1.0-4.el7_5
0:60.1.0-4.el7_5
firefox-debuginfo
Red Hat:enterprise_linux:7::workstation
From an advisory covering 11 CVEs
 before 0:60.1.0-4.el7_5
0:60.1.0-4.el7_5
firefox
Ubuntu:14.04:LTS
 before 54.0+build3-0ubuntu0.14.04.1, plus listed versions
24.0+build1-0ubuntu125.0+build3-0ubuntu0.13.10.128.0~b2+build1-0ubuntu228.0+build1-0ubuntu128.0+build2-0ubuntu1
Show 45 moreShow less
28.0+build2-0ubuntu229.0+build1-0ubuntu0.14.04.230.0+build1-0ubuntu0.14.04.331.0+build1-0ubuntu0.14.04.132.0+build1-0ubuntu0.14.04.132.0.3+build1-0ubuntu0.14.04.133.0+build2-0ubuntu0.14.04.134.0+build2-0ubuntu0.14.04.135.0+build3-0ubuntu0.14.04.235.0.1+build1-0ubuntu0.14.04.136.0+build2-0ubuntu0.14.04.436.0.1+build2-0ubuntu0.14.04.136.0.4+build1-0ubuntu0.14.04.137.0+build2-0ubuntu0.14.04.137.0.1+build1-0ubuntu0.14.04.137.0.2+build1-0ubuntu0.14.04.138.0+build3-0ubuntu0.14.04.139.0+build5-0ubuntu0.14.04.139.0.3+build2-0ubuntu0.14.04.140.0+build4-0ubuntu0.14.04.140.0+build4-0ubuntu0.14.04.440.0.3+build1-0ubuntu0.14.04.141.0+build3-0ubuntu0.14.04.141.0.1+build2-0ubuntu0.14.04.141.0.2+build2-0ubuntu0.14.04.142.0+build2-0ubuntu0.14.04.143.0+build1-0ubuntu0.14.04.143.0.4+build3-0ubuntu0.14.04.144.0+build3-0ubuntu0.14.04.144.0.1+build2-0ubuntu0.14.04.144.0.2+build1-0ubuntu0.14.04.145.0+build2-0ubuntu0.14.04.145.0.1+build1-0ubuntu0.14.04.245.0.2+build1-0ubuntu0.14.04.146.0+build5-0ubuntu0.14.04.246.0.1+build1-0ubuntu0.14.04.347.0+build3-0ubuntu0.14.04.148.0+build2-0ubuntu0.14.04.149.0+build4-0ubuntu0.14.04.149.0.2+build2-0ubuntu0.14.04.150.0+build2-0ubuntu0.14.04.250.0.2+build1-0ubuntu0.14.04.150.1.0+build2-0ubuntu0.14.04.151.0.1+build2-0ubuntu0.14.04.151.0.1+build2-0ubuntu0.14.04.2
54.0+build3-0ubuntu0.14.04.1
firefox
Ubuntu:16.04:LTS
 before 54.0+build3-0ubuntu0.16.04.1, plus listed versions
41.0.2+build2-0ubuntu142.0+build2-0ubuntu144.0+build3-0ubuntu244.0.1+build1-0ubuntu144.0.2+build1-0ubuntu1
Show 20 moreShow less
45.0+build2-0ubuntu145.0.1+build1-0ubuntu145.0.2+build1-0ubuntu146.0+build5-0ubuntu0.16.04.246.0.1+build1-0ubuntu0.16.04.247.0+build3-0ubuntu0.16.04.148.0+build2-0ubuntu0.16.04.149.0+build4-0ubuntu0.16.04.149.0.2+build2-0ubuntu0.16.04.250.0+build2-0ubuntu0.16.04.250.0.2+build1-0ubuntu0.16.04.150.1.0+build2-0ubuntu0.16.04.151.0.1+build2-0ubuntu0.16.04.151.0.1+build2-0ubuntu0.16.04.252.0+build2-0ubuntu0.16.04.152.0.1+build2-0ubuntu0.16.04.152.0.2+build1-0ubuntu0.16.04.153.0+build6-0ubuntu0.16.04.153.0.2+build1-0ubuntu0.16.04.253.0.3+build1-0ubuntu0.16.04.2
54.0+build3-0ubuntu0.16.04.1
firefox
Ubuntu:14.04:LTS
From an advisory covering 21 CVEs
 before 54.0+build3-0ubuntu0.14.04.1, plus listed versions
24.0+build1-0ubuntu125.0+build3-0ubuntu0.13.10.128.0~b2+build1-0ubuntu228.0+build1-0ubuntu128.0+build2-0ubuntu1
Show 45 moreShow less
28.0+build2-0ubuntu229.0+build1-0ubuntu0.14.04.230.0+build1-0ubuntu0.14.04.331.0+build1-0ubuntu0.14.04.132.0+build1-0ubuntu0.14.04.132.0.3+build1-0ubuntu0.14.04.133.0+build2-0ubuntu0.14.04.134.0+build2-0ubuntu0.14.04.135.0+build3-0ubuntu0.14.04.235.0.1+build1-0ubuntu0.14.04.136.0+build2-0ubuntu0.14.04.436.0.1+build2-0ubuntu0.14.04.136.0.4+build1-0ubuntu0.14.04.137.0+build2-0ubuntu0.14.04.137.0.1+build1-0ubuntu0.14.04.137.0.2+build1-0ubuntu0.14.04.138.0+build3-0ubuntu0.14.04.139.0+build5-0ubuntu0.14.04.139.0.3+build2-0ubuntu0.14.04.140.0+build4-0ubuntu0.14.04.140.0+build4-0ubuntu0.14.04.440.0.3+build1-0ubuntu0.14.04.141.0+build3-0ubuntu0.14.04.141.0.1+build2-0ubuntu0.14.04.141.0.2+build2-0ubuntu0.14.04.142.0+build2-0ubuntu0.14.04.143.0+build1-0ubuntu0.14.04.143.0.4+build3-0ubuntu0.14.04.144.0+build3-0ubuntu0.14.04.144.0.1+build2-0ubuntu0.14.04.144.0.2+build1-0ubuntu0.14.04.145.0+build2-0ubuntu0.14.04.145.0.1+build1-0ubuntu0.14.04.245.0.2+build1-0ubuntu0.14.04.146.0+build5-0ubuntu0.14.04.246.0.1+build1-0ubuntu0.14.04.347.0+build3-0ubuntu0.14.04.148.0+build2-0ubuntu0.14.04.149.0+build4-0ubuntu0.14.04.149.0.2+build2-0ubuntu0.14.04.150.0+build2-0ubuntu0.14.04.250.0.2+build1-0ubuntu0.14.04.150.1.0+build2-0ubuntu0.14.04.151.0.1+build2-0ubuntu0.14.04.151.0.1+build2-0ubuntu0.14.04.2
54.0+build3-0ubuntu0.14.04.1
firefox
Ubuntu:16.04:LTS
From an advisory covering 21 CVEs
 before 54.0+build3-0ubuntu0.16.04.1, plus listed versions
41.0.2+build2-0ubuntu142.0+build2-0ubuntu144.0+build3-0ubuntu244.0.1+build1-0ubuntu144.0.2+build1-0ubuntu1
Show 20 moreShow less
45.0+build2-0ubuntu145.0.1+build1-0ubuntu145.0.2+build1-0ubuntu146.0+build5-0ubuntu0.16.04.246.0.1+build1-0ubuntu0.16.04.247.0+build3-0ubuntu0.16.04.148.0+build2-0ubuntu0.16.04.149.0+build4-0ubuntu0.16.04.149.0.2+build2-0ubuntu0.16.04.250.0+build2-0ubuntu0.16.04.250.0.2+build1-0ubuntu0.16.04.150.1.0+build2-0ubuntu0.16.04.151.0.1+build2-0ubuntu0.16.04.151.0.1+build2-0ubuntu0.16.04.252.0+build2-0ubuntu0.16.04.152.0.1+build2-0ubuntu0.16.04.152.0.2+build1-0ubuntu0.16.04.153.0+build6-0ubuntu0.16.04.153.0.2+build1-0ubuntu0.16.04.253.0.3+build1-0ubuntu0.16.04.2
54.0+build3-0ubuntu0.16.04.1

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2017-7762 is a high vulnerability (CVSS 7.5) in Mozilla Firefox, published June 14, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.88%, the 79th percentile. Fixed in firefox 54.0+build3-0ubuntu0.14.04.1.

References

Show 73 moreShow less
This page doesn't list everything

Left out here: 12 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open