CVE-2016-2827

What it actually does

Out-of-bounds read in mozilla::net::IsValidReferrerPolicy triggered by a Content Security Policy referrer directive containing zero values, resulting in application crash.

Why it matters to the business

Browser crashes disrupt user sessions and can be triggered repeatedly against visitors to attacker-controlled sites, affecting productivity for organizations relying on Firefox.

How an attack unfolds

An attacker hosts a web page containing a CSP header with an invalid referrer directive using zero values. When a victim browser loads the page the malformed directive reaches IsValidReferrerPolicy and triggers an out-of-bounds read that crashes the process.

How to fix it

Upgrade Mozilla Firefox to a version that resolves the out-of-bounds read in referrer policy validation.

How to confirm the fix worked

Confirm the installed Firefox version is newer than the vulnerable release and test that pages containing zero-value referrer directives no longer cause crashes.

Typical attack path

1. Attacker prepares a web page embedding a CSP referrer directive with zero values
2. Victim is lured to visit the attacker-controlled page
3. Browser parses the CSP and calls IsValidReferrerPolicy
4. Out-of-bounds read occurs and the application crashes

How to detect it

Review browser crash logs and telemetry for repeated crashes involving CSP referrer parsing; correlate with web proxy logs showing unusual referrer directives.

What your security team should do

• Prioritize patching Firefox across the fleet
• Block known malicious domains that deliver malformed CSP headers
• Monitor crash reports for repeated IsValidReferrerPolicy failures