CVE-2016-1960: Integer underflow in the nsHtml5TreeBuilder class in the HTML5 string parser in Mozilla Firefox before 45.0...

Security readout for executives and security teams

This flaw affected old Mozilla Firefox releases and could let a malicious webpage crash the browser or run code in the browser process. The sources identify Firefox before 45.0 and Firefox ESR 38.x before 38.7. It is historical, but any legacy workstation or bundled browser still running those versions should be treated as exposed. Exposure is most likely on legacy desktops, kiosks, frozen virtual images, or Linux distributions retaining Firefox before 45.0 or ESR 38.x before 38.7. The bundle also lists multiple Linux vendor advisories, indicating downstream package exposure at the time. Treat this as a legacy exposure cleanup item with high impact if vulnerable systems still exist. It should not outrank actively exploited current issues, but any confirmed affected browser should be upgraded or removed quickly. Mitigation focus: Upgrade Firefox to 45.0 or later, or ESR 38.7 or later.; Apply relevant Linux vendor browser updates from Mozilla, SUSE, Ubuntu, Debian, or Oracle.; Remove unsupported legacy Firefox builds from managed endpoints..

Prepared

Jun 13, 2026, 21:06 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.