CVE-2016-9903: Mozilla's add-ons SDK had a world-accessible resource with an HTML injection vulnerability.

Security readout for executives and security teams

CVE-2016-9903 is an old Firefox vulnerability in Mozilla's add-ons SDK. A world-accessible add-on resource had HTML injection risk. The documented impact required another vulnerability to make that resource load as a document, which could let content and script run in an add-on context. Exposure is most likely on legacy systems running Firefox before 50.1. Current, supported Firefox deployments are unlikely to be affected based on the version range in the source bundle. Treat this as a legacy exposure cleanup item unless old Firefox builds are still present in production. It does not indicate active exploitation in the provided sources, but obsolete browsers can create avoidable chained-risk conditions. Mitigation focus: Upgrade Firefox versions below 50.1 using Mozilla guidance.; Retire unsupported Firefox installations from managed endpoints.; Inventory systems that may retain legacy browser builds..

Prepared

Jun 7, 2026, 06:44 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.