Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-hf9p-ajjz-k3ft
Vulnerability ID VCID-hf9p-ajjz-k3ft
Aliases CVE-2015-4476
Summary Security researcher Jordi Chancel reported that on Firefox for Android, when a URL is pasted with an unknown protocol, such as secure: or httpz:, the pasted URL is shown in the addressbar but no navigation occurs. Other addressbar attributes present before this pasted URL is entered will continue to be rendered. This could lead to potential spoofing by a malicious site. This issue only affects Firefox for Android and does not affect Firefox on OS X, Linux, or Windows operating systems.
Status Published
Exploitability None
Weighted Severity None
Risk None
Affected and Fixed Packages Package Details
Weaknesses (1)
CWE-20 Improper Input Validation
System Score Found at
epss 0.00483 https://api.first.org/data/v1/epss?cve=CVE-2015-4476
epss 0.00483 https://api.first.org/data/v1/epss?cve=CVE-2015-4476
epss 0.00483 https://api.first.org/data/v1/epss?cve=CVE-2015-4476
epss 0.00483 https://api.first.org/data/v1/epss?cve=CVE-2015-4476
epss 0.00483 https://api.first.org/data/v1/epss?cve=CVE-2015-4476
epss 0.00483 https://api.first.org/data/v1/epss?cve=CVE-2015-4476
epss 0.00483 https://api.first.org/data/v1/epss?cve=CVE-2015-4476
epss 0.00483 https://api.first.org/data/v1/epss?cve=CVE-2015-4476
epss 0.00483 https://api.first.org/data/v1/epss?cve=CVE-2015-4476
generic_textual none https://www.mozilla.org/en-US/security/advisories/mfsa2015-99
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2015-4476.json
https://api.first.org/data/v1/epss?cve=CVE-2015-4476
1265603 https://bugzilla.redhat.com/show_bug.cgi?id=1265603
CVE-2015-4476 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4476
mfsa2015-99 https://www.mozilla.org/en-US/security/advisories/mfsa2015-99
No exploits are available.
Exploit Prediction Scoring System (EPSS)
Percentile 0.65111
EPSS Score 0.00483
Published At April 1, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-04-01T13:18:25.066385+00:00 Mozilla Importer Import https://github.com/mozilla/foundation-security-advisories/blob/master/announce/2015/mfsa2015-99.md 38.0.0