CVE-2016-9904 — Mozilla: Cross-origin information leak in shared atoms (MFSA 2016-94, MFSA 2016-95)

Back Back to CVE browser

HIGH

Mozilla: Cross-origin information leak in shared atoms (MFSA 2016-94, MFSA 2016-95)

Published Jun 11, 2018

7.5

HIGH

CVSS 3.0

EPSS 2.72%

Description

An attacker could use a JavaScript Map/Set timing attack to determine whether an atom is used by another compartment/zone in specific contexts. This could be used to leak information, such as usernames embedded in JavaScript code, across websites. This vulnerability affects Firefox < 50.1, Firefox ESR < 45.6, and Thunderbird < 45.6.

Affected products

Vendor Mozilla Product Firefox Default
n/a
- Version
  unspecified
  Status
  affected
  Constraints
  <50.1
Vendor Mozilla Product Firefox ESR Default
n/a
- Version
  unspecified
  Status
  affected
  Constraints
  <45.6
Vendor Mozilla Product Thunderbird Default
n/a
- Version
  unspecified
  Status
  affected
  Constraints
  <45.6

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Mozilla

Firefox

n/a

Version	Status	Constraints
unspecified	affected	<50.1

Mozilla

Firefox ESR

n/a

Version	Status	Constraints
unspecified	affected	<45.6

Mozilla

Thunderbird

n/a

Version	Status	Constraints
unspecified	affected	<45.6

Red Hat Enterprise Linux 5

firefox-0:45.6.0-1.el5_11

Fixed · RHSA-2016:2946
Red Hat Enterprise Linux 6

firefox-0:45.6.0-1.el6_8

Fixed · RHSA-2016:2946
Red Hat Enterprise Linux 7

firefox-0:45.6.0-1.el7_3

Fixed · RHSA-2016:2946
Red Hat Enterprise Linux 5

thunderbird

Not affected
Red Hat Enterprise Linux 6

thunderbird

Not affected
Red Hat Enterprise Linux 7

thunderbird

Not affected

Product	Package	State	Advisory
Red Hat Enterprise Linux 5	firefox-0:45.6.0-1.el5_11	Fixed	RHSA-2016:2946
Red Hat Enterprise Linux 6	firefox-0:45.6.0-1.el6_8	Fixed	RHSA-2016:2946
Red Hat Enterprise Linux 7	firefox-0:45.6.0-1.el7_3	Fixed	RHSA-2016:2946
Red Hat Enterprise Linux 5	thunderbird	Not affected	n/a
Red Hat Enterprise Linux 6	thunderbird	Not affected	n/a
Red Hat Enterprise Linux 7	thunderbird	Not affected	n/a

Remediation

No remediation recorded yet.

Metrics

2.72% 0.02718

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.

EPSS probability 0.02718

Score over time

2022–2026

EPSS v2
EPSS v3
EPSS v4
EPSS v5

Percentile over time

EPSS v2
EPSS v3
EPSS v4
EPSS v5

Table of values (16 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 1, 2026	2.72% (0.02718)	85.50th	v5 (v2026.06.15)
Jun 15, 2026	2.75% (0.02753)	84.25th	v5 (v2026.06.15)
Mar 30, 2025	1.30% (0.01304)	77.92th	v4 (v2025.03.14)
Mar 29, 2025	2.60% (0.02605)	76.03th	v4 (v2025.03.14)
Mar 17, 2025	1.33% (0.01329)	78.60th	v4 (v2025.03.14)
Dec 12, 2024	0.19% (0.00187)	57.45th	v3 (v2023.03.01)
Feb 8, 2024	0.37% (0.00373)	71.91th	v3 (v2023.03.01)
Jan 5, 2024	0.37% (0.00373)	69.81th	v3 (v2023.03.01)
Dec 12, 2023	0.47% (0.00475)	72.98th	v3 (v2023.03.01)
Nov 2, 2023	0.77% (0.00769)	79.25th	v3 (v2023.03.01)
Jun 5, 2023	0.95% (0.00947)	80.95th	v3 (v2023.03.01)
Mar 7, 2023	0.80% (0.00798)	78.96th	v3 (v2023.03.01)
Mar 6, 2023	1.54% (0.01537)	74.52th	v2 (v2022.01.01)
Feb 23, 2023	1.54% (0.01537)	74.48th	v2 (v2022.01.01)
Apr 1, 2022	1.54% (0.01537)	72.41th	v2 (v2022.01.01)
Feb 4, 2022	1.54% (0.01537)	51.33th	v2 (v2022.01.01)

Weaknesses (1)

CWE-200

Exposure of Sensitive Information

References (14)

http://rhn.redhat.com/errata/RHSA-2016-2946.html
vendor-advisoryx_refsource_REDHATThird Party Advisory
http://www.securityfocus.com/bid/94885
vdb-entryx_refsource_BIDThird Party AdvisoryVDB Entry
http://www.securitytracker.com/id/1037461
vdb-entryx_refsource_SECTRACKThird Party AdvisoryVDB Entry
https://access.redhat.com/security/cve/CVE-2016-9904
Vendor Advisory
https://bugzilla.mozilla.org/show_bug.cgi?id=1317936
x_refsource_CONFIRMIssue TrackingPatch
https://bugzilla.redhat.com/show_bug.cgi?id=1404091
Issue Tracking
https://nvd.nist.gov/vuln/detail/CVE-2016-9904
https://security.gentoo.org/glsa/201701-15
vendor-advisoryx_refsource_GENTOOThird Party Advisory
https://www.cve.org/CVERecord?id=CVE-2016-9904
https://www.debian.org/security/2017/dsa-3757
vendor-advisoryx_refsource_DEBIANThird Party Advisory
https://www.mozilla.org/security/advisories/mfsa2016-94/
x_refsource_CONFIRMVendor Advisory
https://www.mozilla.org/security/advisories/mfsa2016-95/
x_refsource_CONFIRMVendor Advisory
https://www.mozilla.org/security/advisories/mfsa2016-96/
x_refsource_CONFIRMVendor Advisory
https://www.mozilla.org/security/announce/2016/mfsa2016-95/#CVE-2016-9904

Link	Providers	Tags
http://rhn.redhat.com/errata/RHSA-2016-2946.html		vendor-advisoryx_refsource_REDHATThird Party Advisory
http://www.securityfocus.com/bid/94885		vdb-entryx_refsource_BIDThird Party AdvisoryVDB Entry
http://www.securitytracker.com/id/1037461		vdb-entryx_refsource_SECTRACKThird Party AdvisoryVDB Entry
https://access.redhat.com/security/cve/CVE-2016-9904		Vendor Advisory
https://bugzilla.mozilla.org/show_bug.cgi?id=1317936		x_refsource_CONFIRMIssue TrackingPatch
https://bugzilla.redhat.com/show_bug.cgi?id=1404091		Issue Tracking
https://nvd.nist.gov/vuln/detail/CVE-2016-9904
https://security.gentoo.org/glsa/201701-15		vendor-advisoryx_refsource_GENTOOThird Party Advisory
https://www.cve.org/CVERecord?id=CVE-2016-9904
https://www.debian.org/security/2017/dsa-3757		vendor-advisoryx_refsource_DEBIANThird Party Advisory
https://www.mozilla.org/security/advisories/mfsa2016-94/		x_refsource_CONFIRMVendor Advisory
https://www.mozilla.org/security/advisories/mfsa2016-95/		x_refsource_CONFIRMVendor Advisory
https://www.mozilla.org/security/advisories/mfsa2016-96/		x_refsource_CONFIRMVendor Advisory
https://www.mozilla.org/security/announce/2016/mfsa2016-95/#CVE-2016-9904