CVE-2017-5384: Proxy Auto-Config (PAC) files can specify a JavaScript function called for all URL requests with the full U...

Security readout for executives and security teams

Older Firefox versions could reveal full HTTPS URL paths to Proxy Auto-Config logic. That matters because paths can contain sensitive business data, tokens, document names, or internal application context. The risk is most relevant where Firefox before version 51 remains in use and WPAD or remotely supplied PAC files are enabled. Exposure is likely limited to legacy Firefox installations below version 51, especially managed desktops using WPAD or PAC-based proxy configuration. Current Firefox versions are outside the stated affected range. The bundle does not identify other Mozilla products or non-Mozilla browsers as affected. Prioritize remediation if legacy Firefox and WPAD are still present. The business risk is sensitive URL leakage, which can expose internal activity and application context. If the estate has already removed Firefox below 51, residual urgency is low. Mitigation focus: Upgrade Firefox to version 51 or later.; Disable WPAD where it is not operationally required.; Ensure PAC files come only from trusted, controlled infrastructure..

Prepared

Jun 7, 2026, 06:44 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.