CVE-2016-1967: Mozilla Firefox before 45.0 does not properly restrict the availability of IFRAME Resource Timing API times...

Security readout for executives and security teams

This is a browser privacy boundary flaw in older Firefox. A malicious web page could abuse timing data from iframes to learn sensitive cross-site information that the Same Origin Policy should protect. The source bundle does not show active exploitation or a CVSS score. Exposure is mainly legacy Firefox installations older than 45.0, including distro-packaged Firefox covered by Mozilla, Ubuntu, openSUSE, and Gentoo advisories. Current managed browsers are unlikely to be exposed if browser patching is enforced. Treat this as a legacy-browser hygiene issue unless old Firefox remains in production. It should not displace urgent actively exploited vulnerabilities, but any remaining affected browser should be removed or updated promptly. Mitigation focus: Upgrade Firefox to 45.0 or later where still applicable.; Apply relevant Mozilla or Linux distribution security updates.; Retire unsupported legacy Firefox builds from managed systems..

Prepared

Jun 13, 2026, 21:06 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.