Skip to content
CVE Tracker
Back

CVE-2016-9064

Add-on updates failed to verify that the add-on ID inside the signed package matched the ID of the add-on being updated. An attacker who…

Medium5.9EPSS 0.99%
Published
Updated
Reserved
Assigned by
mozilla

Description

Add-on updates failed to verify that the add-on ID inside the signed package matched the ID of the add-on being updated. An attacker who could perform a man-in-the-middle attack on the user's connection to the update server and defeat the certificate pinning protection could provide a malicious signed add-on instead of a valid update. This vulnerability affects Firefox ESR < 45.5 and Firefox < 50.

Scores

CVSS scores of CVE-2016-9064, by who scored it
Scored byCVSSScoreVector
NVDNVD · Modified3.0Medium5.9CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
EPSS (exploitation in 30 days)
0.99% · top 37% of all CVEs (3 Nov 2026)

Loading the EPSS history…

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.9.

Weakness

Affected products

  • Mozilla · Firefox ESR

    • affected unspecified – < 45.5

  • Mozilla · Firefox

    • affected unspecified – < 50

References (7)

Sources

The same CVE in the primary databases and aggregators, to check against.

Record last updated .