{"id":"CVE-2016-9079","published":"2018-06-11T21:29:01Z","modified":"2026-06-17T00:55:29Z","title":"Mozilla Firefox, Firefox ESR, and Thunderbird Use-After-Free Vulnerability","vendor":"Mozilla","product":"Firefox, Firefox ESR, and Thunderbird","tier":"core","eol":null,"description":{"text":"A use-after-free vulnerability in SVG Animation has been discovered. An exploit built on this vulnerability has been discovered in the wild targeting Firefox and Tor Browser users on Windows. This vulnerability affects Firefox < 50.0.2, Firefox ESR < 45.5.1, and Thunderbird < 45.5.1.","provenance":"source","from":"NVD"},"summary":{"text":"The flaw is a use-after-free vulnerability in the SVG Animation component of Mozilla Firefox, Firefox ESR, and Thunderbird. An attacker can exploit it over the network without authentication or user interaction, with low attack complexity, to compromise confidentiality.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:11:02Z"},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","provenance":"source","from":"NVD"},"epss":{"score":0.87357,"percentile":0.99754,"date":"2026-10-28","provenance":"source"},"kev":{"dateAdded":"2023-06-22","dueDate":"2023-07-13","ransomware":false,"requiredAction":"Apply updates per vendor instructions.","notes":"https://www.mozilla.org/en-US/security/advisories/mfsa2016-92/#CVE-2016-9079; https://nvd.nist.gov/vuln/detail/CVE-2016-9079","provenance":"source"},"vulncheckKev":{"dateAdded":"2016-11-29","exploitedFirstSeen":"2016-11-29","ransomware":false,"evidence":[{"url":"https://docs.google.com/spreadsheets/d/1lkNJ0uQwbeC1ZTRrxdtuPLCIl7mlUreoKfSIgajnSyY/edit","date":"2016-11-29"},{"url":"https://www.forbes.com/sites/thomasbrewster/2016/12/02/exodus-intel-the-company-that-exposed-tor-for-cops-child-porn-bust/?sh=2d4835cc5f8c","date":"2016-12-02"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2023-06-22"}],"evidenceTotal":3,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-416","name":"Use After Free"}],"references":[{"url":"http://rhn.redhat.com/errata/RHSA-2016-2843.html","tags":["Third Party Advisory"]},{"url":"http://rhn.redhat.com/errata/RHSA-2016-2850.html","tags":["Third Party Advisory"]},{"url":"http://www.securityfocus.com/bid/94591","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"http://www.securitytracker.com/id/1037370","tags":["Third Party Advisory","VDB Entry"]},{"url":"https://bugzilla.mozilla.org/show_bug.cgi?id=1321066","tags":["Exploit","Issue Tracking","Vendor Advisory"]},{"url":"https://security.gentoo.org/glsa/201701-15","tags":["Third Party Advisory"]},{"url":"https://security.gentoo.org/glsa/201701-35","tags":["Third Party Advisory"]},{"url":"https://www.debian.org/security/2016/dsa-3730","tags":["Third Party Advisory"]},{"url":"https://www.exploit-db.com/exploits/41151/","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://www.exploit-db.com/exploits/42327/","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://www.mozilla.org/security/advisories/mfsa2016-92/","tags":["Vendor Advisory"]},{"url":"http://rhn.redhat.com/errata/RHSA-2016-2843.html","tags":["Third Party Advisory"]},{"url":"http://rhn.redhat.com/errata/RHSA-2016-2850.html","tags":["Third Party Advisory"]},{"url":"http://www.securityfocus.com/bid/94591","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"http://www.securitytracker.com/id/1037370","tags":["Third Party Advisory","VDB Entry"]},{"url":"https://bugzilla.mozilla.org/show_bug.cgi?id=1321066","tags":["Exploit","Issue Tracking","Vendor Advisory"]},{"url":"https://security.gentoo.org/glsa/201701-15","tags":["Third Party Advisory"]},{"url":"https://security.gentoo.org/glsa/201701-35","tags":["Third Party Advisory"]},{"url":"https://www.debian.org/security/2016/dsa-3730","tags":["Third Party Advisory"]},{"url":"https://www.exploit-db.com/exploits/41151/","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://www.exploit-db.com/exploits/42327/","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://www.mozilla.org/security/advisories/mfsa2016-92/","tags":["Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-9079","tags":["US Government Resource"]}],"techniques":[{"id":"T1189","name":"Drive-by Compromise","tactics":["initial-access"],"provenance":"source","basis":"ctid-cve","bases":["ctid-cve","ai-mapping"],"basisDetail":"CTID attack_to_cve (Phase 1); claude-haiku-5-5: Drive-by via malicious web content in browser","mappingType":"uncategorized","evidence":[{"from":"description","quote":"An exploit built on this vulnerability has been discovered in the wild targeting Firefox","start":69,"end":157}],"confidence":"low","confidenceNote":"server-side bug exploitable without user interaction; client-execution technique does not fit"},{"id":"T1203","name":"Exploitation for Client Execution","tactics":["execution"],"provenance":"source","basis":"ctid-cve","bases":["ctid-cve","ai-mapping"],"basisDetail":"CTID attack_to_cve (Phase 1); claude-haiku-5-5: Browser memory corruption executes attacker code","mappingType":"uncategorized","evidence":[{"from":"description","quote":"A use-after-free vulnerability in SVG Animation has been discovered","start":0,"end":67}],"confidence":"low","confidenceNote":"server-side bug exploitable without user interaction; client-execution technique does not fit"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2016-9900","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2016-9900","exploited":true,"exploitedSince":"2023-06-22","provenance":"source"},"exploits":[{"id":41151,"url":"https://www.exploit-db.com/exploits/41151","title":"Mozilla Firefox < 50.0.2 - 'nsSMILTimeContainer::NotifyTimeChange()' Remote Code Execution (Metasploit)","type":"remote","platform":"windows","date":"2017-01-24","verified":true,"provenance":"source"},{"id":42327,"url":"https://www.exploit-db.com/exploits/42327","title":"Firefox 50.0.1 - ASM.JS JIT-Spray Remote Code Execution","type":"remote","platform":"windows","date":"2017-07-14","verified":false,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":2,"earliest":"2017-01-24"},"pocGithub":{"count":4,"skipped":0,"earliest":"2017-02-08","earliestUrl":"https://github.com/LakshmiDesai/CVE-2016-9079","repos":[{"name":"dangokyo/CVE-2016-9079","url":"https://github.com/dangokyo/CVE-2016-9079","stars":7,"created":"2018-07-29"},{"name":"LakshmiDesai/CVE-2016-9079","url":"https://github.com/LakshmiDesai/CVE-2016-9079","stars":1,"created":"2017-02-08"},{"name":"soham23/firefox-rce-nssmil","url":"https://github.com/soham23/firefox-rce-nssmil","stars":1,"created":"2020-08-06"},{"name":"Tau-hub/Firefox-CVE-2016-9079","url":"https://github.com/Tau-hub/Firefox-CVE-2016-9079","stars":1,"created":"2021-10-08"}]},"metasploit":[{"name":"Firefox nsSMILTimeContainer::NotifyTimeChange() RCE","module":"exploit/windows/browser/firefox_smil_uaf","type":"exploit","disclosureDate":"2016-11-30","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/firefox_smil_uaf.rb"}],"first":{"date":"2016-11-30","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/firefox_smil_uaf.rb"},"provenance":"source"},"exploitRefs":["https://bugzilla.mozilla.org/show_bug.cgi?id=1321066","https://www.exploit-db.com/exploits/41151/","https://www.exploit-db.com/exploits/42327/"],"flow":[{"stage":"related","techniques":["T1189","T1203"],"provenance":"source","lowConfidence":true}],"timeline":[{"date":"2016-11-29","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://docs.google.com/spreadsheets/d/1lkNJ0uQwbeC1ZTRrxdtuPLCIl7mlUreoKfSIgajnSyY/edit","provenance":"source"},{"date":"2016-11-30","kind":"exploit-public","label":"First public exploit: Metasploit; later: Exploit-DB 2017-01-24, PoC-in-GitHub 2017-02-08","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/firefox_smil_uaf.rb","provenance":"source"},{"date":"2018-06-11","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2016-9079","provenance":"source"},{"date":"2023-06-22","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2023-06-22","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2016-9900","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"Metasploit","daysToKev":1837},"priority":{"score":68.2,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 3621 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.95,"detail":"percentile 0.9975"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"3 NVD references tagged Exploit; 2 Exploit-DB entries; 4 PoC-in-GitHub repos; 1 Metasploit module"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":5.25,"detail":"base score 7.5"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}