CVE-2017-5420: A "javascript:" url loaded by a malicious page can obfuscate its location by blanking the URL displayed in...

Security readout for executives and security teams

This is an address-bar spoofing issue in Mozilla Firefox before version 52. A malicious page could use a javascript: URL to hide or blank its displayed location, making a fake page look more trustworthy. The main business risk is credential phishing or user deception, not evidence of system takeover from the supplied sources. Exposure is most likely in legacy environments still running Firefox versions earlier than 52. Current exposure cannot be inferred from the bundle. Asset inventory and browser version telemetry are needed to confirm whether affected clients remain in use. Handle as a legacy-browser hygiene issue with phishing impact. It should be prioritized where outdated Firefox remains in production or on privileged workstations, but the supplied evidence does not support emergency treatment or claims of active exploitation. Mitigation focus: Remove or upgrade Firefox versions earlier than 52.; Use Mozilla advisory MFSA2017-05 as the fixed-version reference.; Block use of obsolete browser builds in managed environments..

Prepared

Jun 7, 2026, 06:44 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.