CVE-2015-4495

What it actually does

The PDF reader component allows crafted JavaScript using a native setter to bypass the Same Origin Policy, enabling arbitrary file reads and privilege escalation within the browser process.

Why it matters to the business

Attackers can steal sensitive files from user systems or escalate access on widely deployed browsers and Linux distributions, leading to data breaches and requiring emergency patching across large environments before the 2022 CISA deadline.

How an attack unfolds

An attacker hosts a malicious web page or PDF that loads in Firefox's PDF reader; the embedded JavaScript exploits the native setter to violate origin boundaries, reading local files or executing code with browser privileges, as observed in active wild exploitation campaigns in 2015.

How to fix it

Upgrade Mozilla Firefox to 39.0.3 or later, Firefox ESR 38.x to 38.1.1 or later, and Firefox OS to 2.2 or later; apply all vendor patches for affected distributions including Ubuntu, Red Hat Enterprise Linux, SUSE, and Oracle Solaris; remove or disable the PDF reader if immediate updates are impossible.

How to confirm the fix worked

Verify browser and OS versions against the fixed releases; test that Same Origin Policy enforcement prevents file reads from PDF-loaded JavaScript; review update logs and package managers for successful installation of the patches.

Typical attack path

1. Deliver malicious PDF or HTML via phishing or compromised site
2. Victim opens the content in an affected Firefox version triggering the PDF reader
3. JavaScript payload uses native setter to bypass Same Origin Policy
4. Read arbitrary local files or escalate privileges within the browser sandbox
5. Exfiltrate data or install further malware

How to detect it

Review web proxy and browser history logs for access to PDFs or pages coinciding with the August 2015 exploitation window; search endpoint telemetry for unexpected file access originating from the PDF reader process; examine Firefox crash reports and security logs for anomalies around PDF rendering.

What your security team should do

• Immediately inventory all Firefox and Firefox OS instances across the environment given its KEV status and past wild exploitation
• Prioritize upgrades to the versions listed in remediation guidance before any other non-critical work
• Monitor EPSS trend and threat actor mentions for any renewed activity spikes
• Implement application allow-listing or browser isolation for high-risk users until patching completes