CVE-2015-4490: The nsCSPHostSrc::permits function in dom/security/nsCSPUtils.cpp in Mozilla Firefox before 40.0 does not i...

Security readout for executives and security teams

This flaw affected Mozilla Firefox before 40.0. Firefox mishandled some Content Security Policy wildcard matching rules, which could weaken a site's XSS defenses in specific situations. It is not listed as known exploited in the provided sources. Exposure is mainly legacy Firefox installations older than 40.0, including systems relying on distribution-packaged Firefox from the 2015 advisory period. Current exposure cannot be inferred from the bundle. Treat this as a legacy-browser hygiene issue unless unsupported Firefox remains in use. It matters because it can weaken a key browser-side control against XSS, but the provided evidence does not show active exploitation. Mitigation focus: Upgrade Firefox to version 40.0 or later where applicable.; Apply relevant operating system vendor Firefox security updates.; Check Mozilla and distribution advisories for product-specific fixed package versions..

Prepared

Jun 13, 2026, 22:22 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.