CVE-2017-5466 in Firefox
Summary
by MITRE
If a page is loaded from an original site through a hyperlink and contains a redirect to a "data:text/html" URL, triggering a reload will run the reloaded "data:text/html" page with its origin set incorrectly. This allows for a cross-site scripting (XSS) attack. This vulnerability affects Thunderbird < 52.1, Firefox ESR < 52.1, and Firefox < 53.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 11/26/2025
This vulnerability represents a sophisticated cross-site scripting flaw that exploits the improper handling of origin attributes during page reload operations involving data URLs. The issue occurs when a web page is initially loaded from a legitimate origin through a hyperlink but subsequently contains a redirect to a data:text/html URL. When the page reloads, the browser executes the data URL content with an incorrect origin context, creating a security boundary violation that enables malicious code execution. The vulnerability specifically affects Mozilla's browser implementations where the origin validation mechanism fails to properly handle the transition between different URL schemes during reload scenarios.
The technical root cause stems from the browser's origin computation logic that incorrectly processes the security context when a page containing a data URL redirect is reloaded. This flaw allows attackers to manipulate the document's origin property through carefully crafted data URLs that contain malicious javascript payloads. The vulnerability exists because the browser fails to properly validate that the origin of data URLs matches the expected security boundaries, creating a window where malicious content can execute with elevated privileges relative to the original site's security context. This misalignment in origin handling creates a pathway for attackers to bypass standard security restrictions that would normally prevent cross-origin script execution.
The operational impact of this vulnerability is significant as it enables attackers to execute arbitrary javascript code within the context of legitimate websites, potentially leading to session hijacking, data theft, or full account compromise. Attackers can craft malicious links that, when clicked and subsequently reloaded, execute their payload with the trust context of the original site. This makes the attack particularly dangerous because the malicious code runs with the same permissions and security context as the legitimate site, making detection difficult. The vulnerability affects widely used browser applications including Thunderbird email client and various Firefox versions, expanding the potential attack surface significantly.
Mitigation strategies should focus on implementing proper origin validation mechanisms during page reload operations, particularly when data URLs are involved in redirect scenarios. Browser vendors should ensure that the origin computation logic properly handles transitions between different URL schemes and that data URLs cannot inherit or manipulate the security context of their parent documents. Security patches should address the specific logic error in origin handling during reload operations and implement stricter validation of URL origins. Organizations should deploy immediate patches for affected versions and consider implementing content security policies that restrict data URL usage in contexts where cross-site scripting attacks could occur. This vulnerability aligns with CWE-79 which describes cross-site scripting flaws, and represents a technique that could be categorized under ATT&CK tactic TA0001 (Initial Access) through malicious link delivery methods.