CVE-2006-6077 in Firefox
Summary
by MITRE
The (1) Password Manager in Mozilla Firefox 2.0, and 1.5.0.8 and earlier; and the (2) Passcard Manager in Netscape 8.1.2 and possibly other versions, do not properly verify that an ACTION URL in a FORM element containing a password INPUT element matches the web site for which the user stored a password, which allows remote attackers to obtain passwords via a password INPUT element on a different web page located on the web site intended for this password.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 04/28/2026
This vulnerability resides in the password management systems of web browsers, specifically affecting Mozilla Firefox versions 2.0 and earlier, as well as Netscape 8.1.2 and potentially other versions. The flaw represents a critical security weakness in the browser's credential storage and retrieval mechanisms, where the password managers fail to validate the authenticity of action URLs associated with password forms. The vulnerability is categorized under CWE-352, which addresses Cross-Site Request Forgery (CSRF) attacks, and aligns with ATT&CK technique T1557 for credential access through web-based attacks.
The technical implementation of this vulnerability stems from insufficient validation of the ACTION attribute within HTML FORM elements that contain password INPUT fields. When users store credentials in their browser's password manager, the system typically associates these credentials with a specific domain or origin. However, this flaw allows malicious actors to craft web pages that contain password forms with ACTION URLs pointing to the same domain where legitimate credentials are stored. The password manager, lacking proper verification mechanisms, will automatically populate the stored password into these forms without confirming that the form's action URL corresponds to the intended target site.
The operational impact of this vulnerability is severe as it enables attackers to harvest user credentials through a sophisticated social engineering attack. An attacker can create a malicious web page that appears to be part of a legitimate website, with a password form that submits to the same domain where the victim has stored credentials. When the victim visits this page, the browser's password manager may automatically fill in the stored password, unknowingly submitting it to the attacker's server. This attack vector is particularly dangerous because it exploits the trust relationship between the user and their browser's password management system, bypassing traditional authentication mechanisms and directly accessing stored credentials.
Mitigation strategies for this vulnerability require both browser vendors and users to implement comprehensive security measures. Browser vendors should enhance their password managers to perform strict validation of ACTION URLs against stored credential origins, ensuring that password forms only auto-fill when the submission URL matches the domain where credentials were originally stored. Users should be educated about the risks of visiting untrusted websites and should regularly review their saved passwords. Additionally, implementing proper content security policies and enabling features such as password manager warnings when encountering mismatched forms can significantly reduce the attack surface. Organizations should also consider implementing multi-factor authentication as an additional layer of protection against credential theft, as outlined in NIST Special Publication 800-63B guidelines for authentication and access control.