Veille CVE

Recherche « Mozilla firefox os »

76 CVE

Critique 1 Élevée 33 Moyenne 42 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « Mozilla firefox os » ✕
  1. CVE-2026-109777 4.3 Moyenne

    Mozilla Firefox · Mozilla Thunderbird

    Information disclosure in the Storage: IndexedDB component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

  2. CVE-2026-109771 4.3 Moyenne

    Mozilla Firefox · Mozilla Thunderbird

    Information disclosure in the WebRTC: Networking component. This vulnerability was fixed in Firefox 158 and Thunderbird 158.

  3. CVE-2026-109769 4.3 Moyenne

    Mozilla Firefox · Mozilla Thunderbird

    Information disclosure in the Networking: Cache component. This vulnerability was fixed in Firefox 158 and Thunderbird 158.

  4. CVE-2026-109767 4.3 Moyenne

    Mozilla Firefox · Mozilla Thunderbird

    Information disclosure in the Networking component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

  5. CVE-2026-109751 4.3 Moyenne

    Mozilla Firefox · Mozilla Thunderbird

    Information disclosure in the Networking component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

  6. CVE-2026-109742 4.3 Moyenne

    Mozilla Firefox · Mozilla Thunderbird

    Information disclosure in the PDF Viewer component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

  7. CVE-2026-109709 8.8 Élevée

    Mozilla Firefox · Mozilla Thunderbird

    Information disclosure, privilege escalation in the Security: Process Sandboxing component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

  8. CVE-2026-103418 8.8 Élevée

    Mozilla Firefox for iOS

    Firefox for iOS directly interpolated the page’s HTML language attribute into translation JavaScript, allowing attacker-controlled markup to execute code in Firefox’s privileged content world and bypass the page’s Content Security Policy. This vulnerability was fixed in Firefox for iOS 157.1.

  9. CVE-2026-103417 5.5 Moyenne

    Mozilla Firefox for iOS

    Firefox for iOS could autofill saved credentials into a new page if cross-origin navigation occurred while the saved-login UI was open. Autofill was not bound to the originating page or rejected when its origin changed. This vulnerability was fixed in Firefox for iOS 157.1.

  10. CVE-2026-96869 4.3 Moyenne

    Mozilla Thunderbird · Mozilla Firefox

    Information disclosure in the Networking component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17.

  11. CVE-2026-100766 4.3 Moyenne

    Mozilla Firefox · Mozilla Thunderbird

    Information disclosure in the Networking: JAR component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.

  12. CVE-2026-92070 4.3 Moyenne

    Mozilla Firefox · Mozilla Thunderbird

    Information disclosure in the Networking component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.

  13. CVE-2026-92044 7.5 Élevée

    Mozilla Firefox · Mozilla Thunderbird

    Information disclosure in the Networking: HTTP component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.

  14. CVE-2026-92031 6.5 Moyenne

    Mozilla Firefox · Mozilla Thunderbird

    Information disclosure in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 156, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.

  15. CVE-2026-86853 4.3 Moyenne

    Mozilla Firefox for iOS · Mozilla firefox mobile

    A malicious webpage could repeatedly trigger external URL schemes, causing system prompts or external application launches. This could make Firefox for iOS temporarily unusable until the page is closed. This vulnerability was fixed in Firefox for iOS 155.1.

  16. CVE-2026-84132 7.5 Élevée

    Mozilla Firefox · Mozilla Thunderbird

    Information disclosure in the Networking: HTTP component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2.

  17. CVE-2026-84130 7.5 Élevée

    Mozilla Firefox · Mozilla Thunderbird

    Information disclosure in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2.

  18. CVE-2026-84127 4.3 Moyenne

    Mozilla Firefox · Mozilla firefox mobile

    Information disclosure in the WebExtensions component in Firefox for Android. This vulnerability was fixed in Firefox 155.

  19. CVE-2026-81267 5.4 Moyenne

    Mozilla Firefox for iOS · Mozilla firefox mobile

    A malicious webpage could stall a popup's cross-origin navigation after commit, causing the address bar to display the destination origin while continuing to render attacker-controlled content. This vulnerability was fixed in Firefox for iOS 155.0.

  20. CVE-2026-74983 8.1 Élevée

    Mozilla Firefox · Mozilla Thunderbird

    Mitigation bypass in the Data Loss Prevention component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.

  21. CVE-2026-74972 4.3 Moyenne

    Mozilla Firefox · Mozilla Thunderbird

    Information disclosure in the DOM: Push Subscriptions component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.

  22. CVE-2026-74971 4.3 Moyenne

    Mozilla Firefox · Mozilla Thunderbird

    Information disclosure in the DOM: UI Events & Focus Handling component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.

  23. CVE-2026-74966 7.5 Élevée

    Mozilla Firefox · Mozilla Thunderbird

    Information disclosure in the Form Autofill component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.

  24. CVE-2026-74958 7.5 Élevée

    Mozilla Firefox · Mozilla Thunderbird

    Information disclosure in the WebRTC component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.

  25. CVE-2026-74954 7.5 Élevée

    Mozilla Firefox · Mozilla Thunderbird

    Information disclosure due to side-channel in the Storage: Cache API component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.

  26. CVE-2026-74948 6.5 Moyenne

    Mozilla Firefox · Mozilla Thunderbird

    Information disclosure in the Graphics component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.

  27. CVE-2026-74945 6.5 Moyenne

    Mozilla Firefox · Mozilla Thunderbird

    Information disclosure in the Graphics: Text component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.

  28. CVE-2026-18809 6.5 Moyenne

    Mozilla Firefox

    Information disclosure in Firefox for Android and Firefox Focus for Android. This vulnerability was fixed in Firefox 153.0.3.

  29. CVE-2026-16405 7.5 Élevée

    Mozilla Firefox · Mozilla Thunderbird

    Information disclosure in the Networking: WebSockets component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.

  30. CVE-2026-16401 8.8 Élevée

    Mozilla Firefox · Mozilla Thunderbird

    Privilege escalation in the Data Loss Prevention component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.

  31. CVE-2026-16400 7.5 Élevée

    Mozilla Firefox · Mozilla Thunderbird

    Information disclosure in the DOM: Security component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.

  32. CVE-2026-16391 7.5 Élevée

    Mozilla Firefox · Mozilla Thunderbird

    Information disclosure in the Storage: IndexedDB component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.

  33. CVE-2026-16386 7.5 Élevée

    Mozilla Firefox · Mozilla Thunderbird

    Information disclosure due to uninitialized memory in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.

  34. CVE-2026-16385 7.5 Élevée

    Mozilla Firefox · Mozilla Thunderbird

    Information disclosure due to uninitialized memory in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.

  35. CVE-2026-16384 7.5 Élevée

    Mozilla Firefox · Mozilla Thunderbird

    Information disclosure due to uninitialized memory in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.

  36. CVE-2026-16374 7.5 Élevée

    Mozilla Firefox · Mozilla Thunderbird

    Information disclosure in the Framework component in DevTools. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.

  37. CVE-2026-16373 7.5 Élevée

    Mozilla Firefox · Mozilla firefox mobile

    Information disclosure in the Privacy component in Firefox for Android. This vulnerability was fixed in Firefox 153.

  38. CVE-2026-16354 7.5 Élevée

    Mozilla Firefox · Mozilla Thunderbird

    Information disclosure in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.

  39. CVE-2026-14906 5.3 Moyenne

    Mozilla Firefox for iOS · Mozilla firefox mobile

    Pages with malicious titles could potentially allow saved PDF content to overwrite PDF files or bundled content within the Firefox for iOS application sandbox. This vulnerability was fixed in Firefox for iOS 152.4.

  40. CVE-2026-13356 6.3 Moyenne

    Mozilla Firefox for iOS · Mozilla firefox

    A malicious webpage could interrupt a pending navigation by enqueuing a synchronous JavaScript dialog, causing the browser UI to display the destination origin in the address bar while continuing to render attacker-controlled content. This vulnerability was fixed in Firefox for iOS 152.3.

  41. CVE-2026-53900 4.3 Moyenne

    Mozilla Firefox for iOS · Mozilla firefox mobile

    Firefox for iOS preserved cookies set on the initial PDF request across cross-origin HTTP redirects in TemporaryDocument, allowing a malicious site to inject arbitrary cookies into requests to an unrelated target domain. This vulnerability was fixed in Firefox for iOS 152.0.

  42. CVE-2026-53899 6.5 Moyenne

    Mozilla Firefox for iOS · Mozilla firefox mobile

    Firefox for iOS used partial domain matching when attaching cookies to PDF requests, allowing a malicious site on a suffix domain to receive cookies belonging to the target site. This vulnerability was fixed in Firefox for iOS 152.0.

  43. CVE-2026-12320 4.3 Moyenne

    Mozilla Firefox · Mozilla Thunderbird

    Information disclosure in the Password Manager component. This vulnerability was fixed in Firefox 152 and Thunderbird 152.

  44. CVE-2026-12313 4.7 Moyenne

    Mozilla Firefox · Mozilla Thunderbird

    Information disclosure, sandbox escape in the Security: Process Sandboxing component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12.

  45. CVE-2026-12311 4.7 Moyenne

    Mozilla Firefox · Mozilla Thunderbird

    Information disclosure, sandbox escape in the Security: Process Sandboxing component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12.

  46. CVE-2026-12303 4.3 Moyenne

    Mozilla Firefox · Mozilla Thunderbird

    Information disclosure due to incorrect boundary conditions in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 152 and Thunderbird 152.

  47. CVE-2026-12068 7.4 Élevée

    Gen Digital Avira Password Manager

    Information disclosure vulnerability in Avira Password Manager when used with Mozilla Firefox may allow a remote attacker operating a cross-origin iframe to obtain credentials autofilled for the parent web page via incorrect autofill field selection. This issue affects Avira Password Manager when used with Mozilla Firefox on Windows, macOS, and Linux.

  48. CVE-2026-9309 5.4 Moyenne

    Mozilla Firefox for iOS · Mozilla firefox

    Firefox for iOS Reader View did not properly escape HTML tags in JSON-LD metadata. A malicious page could inject markup that changed Reader View behavior and leaked sensitive URL parameters. These parameters could then be used to access internal pages, potentially resulting in arbitrary JavaScript execution in an internal origin. This vulnerability was fixed in Firefox for iOS 151.2.

  49. CVE-2026-9308 5.4 Moyenne

    Mozilla Firefox for iOS · Mozilla firefox

    Firefox for iOS Reader View replaced page content in its HTML template before replacing other internal placeholders. A malicious page could include a placeholder string that was later substituted with JSON-LD data, potentially resulting in arbitrary JavaScript execution. This vulnerability was fixed in Firefox for iOS 151.2.

  50. CVE-2026-9078 5.4 Moyenne

    Mozilla Firefox for iOS · Mozilla firefox

    Firefox for iOS displayed specially crafted right-to-left (RTL) and internationalized domain names (IDNs) incorrectly in link preview UI surfaces. A crafted RTL hostname could visually reorder portions of the displayed domain, causing attacker-controlled sites to appear as trusted origins. This vulnerability was fixed in Firefox for iOS 151.1.

  51. CVE-2026-8706 6.5 Moyenne

    Mozilla Firefox for iOS · Mozilla firefox

    Firefox for iOS hosted Reader mode on an unauthenticated local web server, allowing another application on the same device to request arbitrary URLs and receive the response rendered with the signed-in user's cookies. This vulnerability was fixed in Firefox for iOS 151.0.

  52. CVE-2026-8967 7.5 Élevée

    Mozilla Firefox · Mozilla Thunderbird

    Information disclosure in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 151 and Thunderbird 151.

  53. CVE-2026-8966 7.5 Élevée

    Mozilla Firefox · Mozilla Thunderbird

    Information disclosure in the IP Protection component. This vulnerability was fixed in Firefox 151 and Thunderbird 151.

  54. CVE-2026-8965 7.5 Élevée

    Mozilla Firefox · Mozilla Thunderbird

    Information disclosure in the DOM: Security component. This vulnerability was fixed in Firefox 151 and Thunderbird 151.

  55. CVE-2026-8958 8.6 Élevée

    Mozilla Firefox · Mozilla Thunderbird

    Information disclosure, sandbox escape in the Security: Process Sandboxing component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.

  56. CVE-2026-7320 7.5 Élevée

    Mozilla Firefox · Mozilla Thunderbird · Red Hat Enterprise Linux 10 · Red Hat Enterprise Linux 10.0 Extended Update Support

    Information disclosure due to incorrect boundary conditions in the Audio/Video component. This vulnerability was fixed in Firefox 150.0.1, Firefox ESR 140.10.1, Firefox ESR 115.35.1, Thunderbird 150.0.1, and Thunderbird 140.10.1.

  57. CVE-2025-11711 6.5 Moyenne

    Mozilla Firefox · Mozilla Thunderbird

    There was a way to change the value of JavaScript Object properties that were supposed to be non-writeable. This vulnerability was fixed in Firefox 144, Firefox ESR 115.29, Firefox ESR 140.4, Thunderbird 144, and Thunderbird 140.4.

  58. CVE-2025-10536 6.2 Moyenne

    Mozilla Firefox · Mozilla Thunderbird

    Information disclosure in the Networking: Cache component. This vulnerability was fixed in Firefox 143, Firefox ESR 140.3, Thunderbird 143, and Thunderbird 140.3.

  59. CVE-2025-10290 6.5 Moyenne

    Mozilla Focus for iOS · Mozilla firefox focus

    Opening links via the contextual menu in Focus iOS for certain URL schemes would fail to load but would not refresh the toolbar correctly, allowing attackers to spoof websites if users were coerced into opening a link explicitly through a long-press. This vulnerability was fixed in Focus for iOS 143.0.

  60. CVE-2025-6430 6.1 Moyenne

    Mozilla Firefox · Mozilla Thunderbird

    When a file download is specified via the `Content-Disposition` header, that directive would be ignored if the file was included via a `<embed>` or `<object>` tag, potentially making a website vulnerable to a cross-site scripting attack. This vulnerability was fixed in Firefox 140, Firefox ESR 128.12, Thunderbird 140, and Thunderbird 128.12.

  61. CVE-2025-6426 8.8 Élevée

    Mozilla Firefox · Mozilla Thunderbird

    The executable file warning did not warn users before opening files with the `terminal` extension. *This bug only affects Firefox for macOS. Other versions of Firefox are unaffected.*. This vulnerability was fixed in Firefox 140, Firefox ESR 128.12, Thunderbird 140, and Thunderbird 128.12.

  62. CVE-2023-5217 8.8 Élevée Exploitée

    Google Chrome · Google libvpx · Webmproject libvpx · Microsoft edge

    Heap buffer overflow in vp8 encoding in libvpx in Google Chrome prior to 117.0.5938.132 and libvpx 1.13.1 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

  63. CVE-2023-4863 8.8 Élevée Exploitée

    Google Chrome · Google libwebp · Fedoraproject fedora · Debian debian linux

    Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: Critical)

  64. CVE-2023-4045 5.3 Moyenne

    mozilla firefox · Mozilla Firefox ESR · Debian debian linux

    Offscreen Canvas did not properly track cross-origin tainting, which could have been used to access image data from another site in violation of same-origin policy. This vulnerability affects Firefox < 116, Firefox ESR < 102.14, and Firefox ESR < 115.1.

  65. CVE-2023-37207 6.5 Moyenne

    Mozilla Firefox · Mozilla Firefox ESR · Mozilla Thunderbird · Debian debian linux

    A website could have obscured the fullscreen notification by using a URL with a scheme handled by an external program, such as a mailto URL. This could have led to user confusion and possible spoofing attacks. This vulnerability affects Firefox < 115, Firefox ESR < 102.13, and Thunderbird < 102.13.

  66. CVE-2023-37202 8.8 Élevée

    Mozilla Firefox · Mozilla Firefox ESR · Mozilla Thunderbird · Debian debian linux

    Cross-compartment wrappers wrapping a scripted proxy could have caused objects from other compartments to be stored in the main compartment resulting in a use-after-free. This vulnerability affects Firefox < 115, Firefox ESR < 102.13, and Thunderbird < 102.13.

  67. CVE-2023-29545 6.5 Moyenne

    Mozilla Firefox · Mozilla Firefox ESR · Mozilla Thunderbird

    Similar to CVE-2023-28163, this time when choosing 'Save Link As', suggested filenames containing environment variable names would have resolved those in the context of the current user. *This bug only affects Firefox and Thunderbird on Windows. Other versions of Firefox and Thunderbird are unaffected.* This vulnerability affects Firefox < 112, Firefox ESR < 102.10, and Thunderbird < 102.10.

  68. CVE-2023-29531 9.8 Critique

    Mozilla Firefox · Mozilla Firefox ESR · Mozilla Thunderbird

    An attacker could have caused an out of bounds memory access using WebGL APIs, leading to memory corruption and a potentially exploitable crash. *This bug only affects Firefox and Thunderbird for macOS. Other operating systems are unaffected.* This vulnerability affects Firefox < 112, Firefox ESR < 102.10, and Thunderbird < 102.10.

  69. CVE-2023-32212 4.3 Moyenne

    Mozilla Firefox · Mozilla Firefox ESR · Mozilla Thunderbird

    An attacker could have positioned a `datalist` element to obscure the address bar. This vulnerability affects Firefox < 113, Firefox ESR < 102.11, and Thunderbird < 102.11.

  70. CVE-2023-32207 8.8 Élevée

    Mozilla Firefox · Mozilla Firefox ESR · Mozilla Thunderbird

    A missing delay in popup notifications could have made it possible for an attacker to trick a user into granting permissions. This vulnerability affects Firefox < 113, Firefox ESR < 102.11, and Thunderbird < 102.11.

  71. CVE-2023-29539 8.8 Élevée

    Mozilla Firefox · Mozilla Focus for Android · Mozilla Firefox ESR · Mozilla Firefox for Android

    When handling the filename directive in the Content-Disposition header, the filename would be truncated if the filename contained a NULL character. This could have led to reflected file download attacks potentially tricking users to install malware. This vulnerability affects Firefox < 112, Focus for Android < 112, Firefox ESR < 102.10, Firefox for Android < 112, and Thunderbird < 102.10.

  72. CVE-2023-28164 6.5 Moyenne

    Mozilla Firefox · Mozilla Firefox ESR · Mozilla Thunderbird

    Dragging a URL from a cross-origin iframe that was removed during the drag could have led to user confusion and website spoofing attacks. This vulnerability affects Firefox < 111, Firefox ESR < 102.9, and Thunderbird < 102.9.

  73. CVE-2023-28163 6.5 Moyenne

    Mozilla Firefox · Mozilla Firefox ESR · Mozilla Thunderbird

    When downloading files through the Save As dialog on Windows with suggested filenames containing environment variable names, Windows would have resolved those in the context of the current user. <br>*This bug only affects Firefox on Windows. Other versions of Firefox are unaffected.*. This vulnerability affects Firefox < 111, Firefox ESR < 102.9, and Thunderbird < 102.9.

  74. CVE-2023-25735 8.8 Élevée

    Mozilla Firefox · Mozilla Thunderbird · Mozilla Firefox ESR

    Cross-compartment wrappers wrapping a scripted proxy could have caused objects from other compartments to be stored in the main compartment resulting in a use-after-free after unwrapping the proxy. This vulnerability affects Firefox < 110, Thunderbird < 102.8, and Firefox ESR < 102.8.

  75. CVE-2023-23601 6.5 Moyenne

    Mozilla Firefox · Mozilla Firefox ESR · Mozilla Thunderbird

    Navigations were being allowed when dragging a URL from a cross-origin iframe into the same tab which could lead to website spoofing attacks This vulnerability affects Firefox < 109, Firefox ESR < 102.7, and Thunderbird < 102.7.

  76. CVE-2015-4495 8.8 Élevée Exploitée

    Mozilla firefox · Mozilla firefox os · Oracle solaris · Canonical ubuntu linux

    The PDF reader in Mozilla Firefox before 39.0.3, Firefox ESR 38.x before 38.1.1, and Firefox OS before 2.2 allows remote attackers to bypass the Same Origin Policy, and read arbitrary files or gain privileges, via vectors involving crafted JavaScript code and a native setter, as exploited in the wild in August 2015.