CVE-2016-1940 Other in n/a
Remote attackers can spoof the address bar in Firefox for Android via mishandled data URLs, potentially misleading users about the current site.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2016-1940?
CVE-2016-1940 is a medium-severity vulnerability in Google Android, published on 31 Jan 2016. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Mozilla Firefox before 44.0 on Android allows remote attackers to spoof the address bar via a data: URL that is mishandled during (1) shortcut opening or (2) BOOKMARK intent processing.
Weakness: CWE-17
Which versions are affected by CVE-2016-1940?
It affects 2 products.
Products include Google Android, Mozilla Firefox.
How do I fix CVE-2016-1940?
No fix has been published for CVE-2016-1940 yet. Limit exposure of the affected software until one is available.
Is CVE-2016-1940 being exploited?
There is no known exploitation of CVE-2016-1940 in the wild and no public exploit code.
Other vulnerabilities in Google Android
Sources
Also known as GHSA-67pg-xc6g-cjvr.