CVE-2015-7195: The URL parsing implementation in Mozilla Firefox before 42.0 improperly recognizes escaped characters in h...

Security readout for executives and security teams

This flaw affected Mozilla Firefox before 42.0. A malicious site could use a redirect with specially escaped hostname characters to make Firefox misinterpret the destination and expose sensitive information. The business risk is mainly legacy browser exposure, not modern Firefox installations. Exposure is most likely on unmanaged, embedded, kiosk, lab, or legacy systems still running Firefox before 42.0 or old distribution packages referenced by vendor advisories. Current supported Firefox installations should already contain the fix. Prioritize this during legacy browser cleanup. It is not KEV-listed in the supplied data, but old browsers create recurring exposure and are often missed in endpoint programs. Mitigation focus: Upgrade Firefox to version 42.0 or later where still present.; Apply relevant vendor distribution updates from Mozilla, Ubuntu, Gentoo, openSUSE, or Oracle guidance.; Retire unsupported systems that cannot receive browser security updates..

Prepared

Jun 13, 2026, 21:45 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.