CVE-2017-5408: Video files loaded video captions cross-origin without checking for the presence of CORS headers permitting...

Security readout for executives and security teams

This is an information disclosure flaw in older Mozilla products. A malicious or unexpected web context could cause video captions to be loaded across origins without the required CORS permission check, potentially exposing caption data. The main business risk is legacy browser or Thunderbird installations that missed 2017 vendor updates. Exposure is most likely in unmanaged desktops, frozen enterprise images, legacy ESR deployments, or old Linux packages that still run affected Mozilla versions. Current supported Mozilla and distribution packages should not normally be exposed if 2017 security updates were applied. Treat this as a legacy hygiene issue unless affected versions remain in use. It should be prioritized in endpoint modernization and unsupported software removal, not as an emergency absent evidence of active exploitation. Mitigation focus: Upgrade Firefox to 52 or later where applicable.; Upgrade Firefox ESR to 45.8 or later where applicable.; Upgrade Thunderbird to 52 or 45.8 or later as appropriate..

Prepared

Jun 7, 2026, 06:44 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.