CVE-2015-7186: Mozilla Firefox before 42.0 on Android allows user-assisted remote attackers to bypass the Same Origin Poli...

Security readout for executives and security teams

This is an old Firefox for Android issue affecting versions before 42.0. A victim had to save or open a crafted local HTML file, after which browser origin protections could be bypassed to start a download or read cached profile data. The risk is mainly legacy mobile exposure, not modern patched browsers. Exposure is most plausible on unmanaged or legacy Android devices still running Firefox for Android before 42.0. Current managed fleets are unlikely to be exposed if mobile browsers are regularly updated. The bundle does not identify other affected products beyond Firefox for Android. Prioritize this as a legacy hygiene issue unless your organization still permits old Android browsers. The business risk is unauthorized access to cached browser profile data or unwanted downloads after user interaction. Remediation should be straightforward through mobile browser update enforcement. Mitigation focus: Upgrade Firefox for Android to version 42.0 or later.; Inventory Android devices for Firefox versions older than 42.0.; Remove or isolate devices that cannot receive browser updates..

Prepared

Jun 13, 2026, 21:45 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.