Search for vulnerabilities
Vulnerability details: VCID-qp45-51af-syhx
Vulnerability ID VCID-qp45-51af-syhx
Aliases CVE-2014-1511
Summary Security researcher Mariusz Mlynski, via TippingPoint's Pwn2Own contest, reported that it is possible for untrusted web content to load a chrome-privileged page by getting JavaScript-implemented WebIDL to call window.open(). A second bug allowed the bypassing of the popup-blocker without user interaction. Combined these two bugs allow an attacker to load a JavaScript URL that is executed with the full privileges of the browser, which allows arbitrary code execution. In general this flaw cannot be exploited through email in the Thunderbird and Seamonkey products because scripting is disabled, but is potentially a risk in browser or browser-like contexts.
Status Published
Exploitability 2.0
Weighted Severity 9.0
Risk 10.0
Affected and Fixed Packages Package Details
Weaknesses (0)
There are no known CWE.
System Score Found at
epss 0.75961 https://api.first.org/data/v1/epss?cve=CVE-2014-1511
epss 0.75961 https://api.first.org/data/v1/epss?cve=CVE-2014-1511
epss 0.75961 https://api.first.org/data/v1/epss?cve=CVE-2014-1511
epss 0.75961 https://api.first.org/data/v1/epss?cve=CVE-2014-1511
epss 0.75961 https://api.first.org/data/v1/epss?cve=CVE-2014-1511
epss 0.75961 https://api.first.org/data/v1/epss?cve=CVE-2014-1511
epss 0.75961 https://api.first.org/data/v1/epss?cve=CVE-2014-1511
epss 0.75961 https://api.first.org/data/v1/epss?cve=CVE-2014-1511
epss 0.75961 https://api.first.org/data/v1/epss?cve=CVE-2014-1511
generic_textual critical https://www.mozilla.org/en-US/security/advisories/mfsa2014-29
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2014-1511.json
https://api.first.org/data/v1/epss?cve=CVE-2014-1511
1077490 https://bugzilla.redhat.com/show_bug.cgi?id=1077490
CVE-2014-1511 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1511
mfsa2014-29 https://www.mozilla.org/en-US/security/advisories/mfsa2014-29
RHSA-2014:0310 https://access.redhat.com/errata/RHSA-2014:0310
RHSA-2014:0316 https://access.redhat.com/errata/RHSA-2014:0316
USN-2150-1 https://usn.ubuntu.com/2150-1/
USN-2151-1 https://usn.ubuntu.com/2151-1/
Data source Metasploit
Description This exploit gains remote code execution on Firefox 22-27 by abusing two separate privilege escalation vulnerabilities in Firefox's Javascript APIs.
Note 
Reliability:
  - unknown-reliability
Stability:
  - unknown-stability
SideEffects:
  - unknown-side-effects
Ransomware campaign use Unknown
Source publication date March 17, 2014
Source URL https://github.com/rapid7/metasploit-framework/tree/master/modules/exploits/multi/browser/firefox_webidl_injection.rb
Data source Exploit-DB
Date added Aug. 28, 2014
Description Mozilla Firefox - WebIDL Privileged JavaScript Injection (Metasploit)
Ransomware campaign use Known
Source publication date Aug. 28, 2014
Exploit type remote
Platform multiple
Source update date Aug. 28, 2014
Exploit Prediction Scoring System (EPSS)
Percentile 0.98859
EPSS Score 0.75961
Published At Aug. 6, 2025, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2025-07-31T08:10:44.419856+00:00 Mozilla Importer Import https://github.com/mozilla/foundation-security-advisories/blob/master/announce/2014/mfsa2014-29.md 37.0.0