CVE-2016-5274

Critical

Published: 22/09/2016(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

A use-after-free vulnerability in the nsFrameManager::CaptureFrameState function in Mozilla Firefox before 49.0, Firefox ESR 45.x before 45.4, and Thunderbird < 45.4 allows remote attackers to execute arbitrary code by leveraging improper interaction between restyling and the Web Animations model implementation.

Risk Assessment

An attacker could exploit this vulnerability to execute arbitrary code remotely, potentially leading to system compromise or data theft.

Recommendation

It is recommended to update Mozilla Firefox to version 49.0 or later, Firefox ESR to version 45.4 or later, and Thunderbird to version 45.4 or later to mitigate the risk associated with this vulnerability.

Original NVD description (English source)

Use-after-free vulnerability in the nsFrameManager::CaptureFrameState function in Mozilla Firefox before 49.0, Firefox ESR 45.x before 45.4, and Thunderbird < 45.4 allows remote attackers to execute arbitrary code by leveraging improper interaction between restyling and the Web Animations model implementation.