{"id":"CVE-2015-4495","published":"2015-08-08T00:59:04Z","modified":"2026-06-17T00:27:24Z","title":"Mozilla Firefox Security Feature Bypass Vulnerability","vendor":"Mozilla","product":"Firefox","tier":"core","eol":null,"description":{"text":"The PDF reader in Mozilla Firefox before 39.0.3, Firefox ESR 38.x before 38.1.1, and Firefox OS before 2.2 allows remote attackers to bypass the Same Origin Policy, and read arbitrary files or gain privileges, via vectors involving crafted JavaScript code and a native setter, as exploited in the wild in August 2015.","provenance":"source","from":"NVD"},"summary":{"text":"The security feature bypass lives in the PDF reader component of Mozilla Firefox, affecting versions before 39.0.3, Firefox ESR 38.x before 38.1.1, and Firefox OS before 2.2. An attacker can use crafted JavaScript that abuses a native setter to bypass the Same Origin Policy and read arbitrary files or gain privileges, and this requires the attacker to remotely lure a victim into opening the malicious content, which requires user interaction.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:10:26Z"},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.68558,"percentile":0.99336,"date":"2026-10-28","provenance":"source"},"kev":{"dateAdded":"2022-05-25","dueDate":"2022-06-15","ransomware":false,"requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2015-4495","provenance":"source"},"vulncheckKev":{"dateAdded":"2015-08-05","exploitedFirstSeen":"2015-08-05","ransomware":false,"evidence":[{"url":"https://docs.google.com/spreadsheets/d/1lkNJ0uQwbeC1ZTRrxdtuPLCIl7mlUreoKfSIgajnSyY/edit","date":"2015-08-05"},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-4495","date":"2015-08-08"},{"url":"https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/terror-exploit-kit-more-like-error-exploit-kit/","date":"2017-01-09"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2022-05-25"}],"evidenceTotal":4,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-346","name":"Origin Validation Error"},{"id":"CWE-200","name":"Exposure of Sensitive Information to an Unauthorized Actor"}],"references":[{"url":"http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00009.html","tags":["Mailing List","Third Party Advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00010.html","tags":["Mailing List","Third Party Advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00014.html","tags":["Mailing List","Third Party Advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00015.html","tags":["Mailing List","Third Party Advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00021.html","tags":["Mailing List","Third Party Advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00016.html","tags":["Mailing List","Third Party Advisory"]},{"url":"http://rhn.redhat.com/errata/RHSA-2015-1581.html","tags":["Third Party Advisory"]},{"url":"http://www.mozilla.org/security/announce/2015/mfsa2015-78.html","tags":["Vendor Advisory"]},{"url":"http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html","tags":["Patch","Third Party Advisory"]},{"url":"http://www.securityfocus.com/bid/76249","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"http://www.securitytracker.com/id/1033216","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"http://www.ubuntu.com/usn/USN-2707-1","tags":["Third Party Advisory"]},{"url":"https://blog.mozilla.org/security/2015/08/06/firefox-exploit-found-in-the-wild/","tags":["Issue Tracking","Vendor Advisory"]},{"url":"https://bugzilla.mozilla.org/show_bug.cgi?id=1178058","tags":["Issue Tracking"]},{"url":"https://bugzilla.mozilla.org/show_bug.cgi?id=1179262","tags":["Issue Tracking"]},{"url":"https://security.gentoo.org/glsa/201512-10","tags":["Third Party Advisory"]},{"url":"https://www.exploit-db.com/exploits/37772/","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00009.html","tags":["Mailing List","Third Party Advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00010.html","tags":["Mailing List","Third Party Advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00014.html","tags":["Mailing List","Third Party Advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00015.html","tags":["Mailing List","Third Party Advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00021.html","tags":["Mailing List","Third Party Advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00016.html","tags":["Mailing List","Third Party Advisory"]},{"url":"http://rhn.redhat.com/errata/RHSA-2015-1581.html","tags":["Third Party Advisory"]},{"url":"http://www.mozilla.org/security/announce/2015/mfsa2015-78.html","tags":["Vendor Advisory"]},{"url":"http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html","tags":["Patch","Third Party Advisory"]},{"url":"http://www.securityfocus.com/bid/76249","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"http://www.securitytracker.com/id/1033216","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"http://www.ubuntu.com/usn/USN-2707-1","tags":["Third Party Advisory"]},{"url":"https://blog.mozilla.org/security/2015/08/06/firefox-exploit-found-in-the-wild/","tags":["Issue Tracking","Vendor Advisory"]},{"url":"https://bugzilla.mozilla.org/show_bug.cgi?id=1178058","tags":["Issue Tracking"]},{"url":"https://bugzilla.mozilla.org/show_bug.cgi?id=1179262","tags":["Issue Tracking"]},{"url":"https://security.gentoo.org/glsa/201512-10","tags":["Third Party Advisory"]},{"url":"https://www.exploit-db.com/exploits/37772/","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-4495","tags":["US Government Resource"]}],"techniques":[{"id":"T1189","name":"Drive-by Compromise","tactics":["initial-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: drive-by via crafted JavaScript in browser","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"allows remote attackers to bypass the Same Origin Policy","start":107,"end":163}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1005","name":"Data from Local System","tactics":["collection"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: arbitrary local file read from browser","mappingType":"primary_impact","evidence":[{"from":"description","quote":"read arbitrary files or gain privileges","start":169,"end":208}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2015-4515","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2015-4515","exploited":true,"exploitedSince":"2022-05-25","provenance":"source"},"exploits":[{"id":37772,"url":"https://www.exploit-db.com/exploits/37772","title":"Mozilla Firefox < 39.03 - 'pdf.js' Same Origin Policy","type":"local","platform":"multiple","date":"2015-08-15","verified":false,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":1,"earliest":"2015-08-15"},"pocGithub":{"count":1,"skipped":0,"earliest":"2015-08-10","earliestUrl":"https://github.com/vincd/CVE-2015-4495","repos":[{"name":"vincd/CVE-2015-4495","url":"https://github.com/vincd/CVE-2015-4495","stars":1,"created":"2015-08-10"}]},"metasploit":[{"name":"Firefox PDF.js Browser File Theft","module":"auxiliary/gather/firefox_pdfjs_file_theft","type":"auxiliary","disclosureDate":null,"url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/gather/firefox_pdfjs_file_theft.rb"}],"first":{"date":"2015-08-10","source":"PoC-in-GitHub","url":"https://github.com/vincd/CVE-2015-4495"},"provenance":"source"},"exploitRefs":["https://www.exploit-db.com/exploits/37772/"],"flow":[{"stage":"exploitation","techniques":["T1189"],"provenance":"ai"},{"stage":"primary","techniques":["T1005"],"provenance":"ai"}],"timeline":[{"date":"2015-08-05","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://docs.google.com/spreadsheets/d/1lkNJ0uQwbeC1ZTRrxdtuPLCIl7mlUreoKfSIgajnSyY/edit","provenance":"source"},{"date":"2015-08-08","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2015-4495","provenance":"source"},{"date":"2015-08-10","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub; later: Exploit-DB 2015-08-15","url":"https://github.com/vincd/CVE-2015-4495","provenance":"source"},{"date":"2022-05-25","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2022-05-25","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2015-4515","provenance":"source"}],"speed":{"daysToPublicExploit":2,"firstExploitFrom":"PoC-in-GitHub","daysToKev":2482},"priority":{"score":69.0,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 4103 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.87,"detail":"percentile 0.9934"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 NVD reference tagged Exploit; 1 Exploit-DB entry; 1 PoC-in-GitHub repo; 1 Metasploit module"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.16,"detail":"base score 8.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"familyId":"fam-class-mozilla-firefox-cwe-346"}}