CVE-2017-7822: The AES-GCM implementation in WebCrypto API accepts 0-length IV when it should require a length of 1 accord...

Security readout for executives and security teams

Firefox versions before 56 accepted an invalid zero-length AES-GCM initialization vector in the WebCrypto API. Mozilla reported that this could let an authentication key be determined in some cases. Business impact is mainly legacy-browser exposure where sensitive web applications rely on browser WebCrypto operations. Exposure is limited to users or managed endpoints running Firefox earlier than version 56. The provided sources identify Mozilla Firefox only; no other Mozilla products or browsers are cited as affected. Treat as legacy-risk cleanup unless Firefox < 56 remains in use. There is no cited active exploitation, but cryptographic key impact warrants prompt remediation where affected browsers exist. Mitigation focus: Upgrade Firefox to version 56 or a current supported release.; Remove or block unsupported Firefox versions from managed environments.; Check Mozilla advisory MFSA2017-21 for vendor context..

Prepared

Jun 7, 2026, 06:44 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.