CVE-2017-5378 in Firefox
Summary
by MITRE
Hashed codes of JavaScript objects are shared between pages. This allows for pointer leaks because an object's address can be discovered through hash codes, and also allows for data leakage of an object's content using these hash codes. This vulnerability affects Thunderbird < 45.7, Firefox ESR < 45.7, and Firefox < 51.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 11/26/2025
This vulnerability represents a critical information disclosure flaw in web browser implementations that affects the core JavaScript engine's object hashing mechanism. The issue stems from how JavaScript engines generate hash codes for objects, which are used internally for performance optimization and data structure management. When hash codes are computed using predictable algorithms that incorporate object memory addresses or other identifiable characteristics, they can inadvertently leak sensitive information about object locations in memory. This particular vulnerability affects Mozilla Firefox and Thunderbird products across multiple versions, specifically targeting the JavaScript engine's handling of object identity and hashing operations that are fundamental to the browser's execution environment.
The technical flaw manifests when JavaScript objects are hashed using algorithms that expose memory layout information through their hash values. This creates a pointer leak scenario where an attacker can determine the memory address of objects by analyzing their hash codes, effectively bypassing memory protection mechanisms. The vulnerability operates at the intersection of memory management and security design, where the hash function's output reveals information about the underlying object structure that should remain hidden from user-space code. According to CWE standards, this maps to CWE-200 Information Exposure, specifically through the leakage of memory addresses and object contents through hash code analysis. The attack vector leverages the fact that hash functions used in JavaScript engines are not properly randomized or obfuscated, allowing for deterministic analysis of object properties through their computed hash values.
The operational impact of this vulnerability extends beyond simple information disclosure to potentially enable more sophisticated attacks within the browser environment. An attacker who can predict or determine object addresses through hash code analysis can craft exploits that target specific memory locations, potentially leading to arbitrary code execution or data manipulation. This type of vulnerability is particularly dangerous in the context of browser security because it undermines fundamental isolation mechanisms between different web pages and processes. The vulnerability affects not just the current page but can potentially allow cross-site information leakage between different origins, violating the same-origin policy that is critical for web security. From an ATT&CK framework perspective, this vulnerability aligns with techniques involving information gathering and privilege escalation through memory analysis and object manipulation.
The remediation approach for this vulnerability requires modifications to the JavaScript engine's hash function implementation to ensure that hash codes do not expose memory addresses or object characteristics. This involves implementing randomized or salted hash functions that prevent predictable patterns from emerging in hash values. Browser vendors addressed this issue by updating their JavaScript engines to use more secure hashing algorithms that do not leak object location information. The fix typically involves changes to the internal object management systems where hash codes are generated, ensuring that these values remain unpredictable and do not provide attackers with useful information about the underlying memory layout. Security researchers recommend that organizations update to patched versions immediately, as the vulnerability can be exploited in the context of cross-site scripting attacks or other malicious code execution scenarios that leverage memory disclosure vulnerabilities.