The host is installed with Mozilla Firefox from 48.0 before 50.1 or Firefox ESR from 45.3 before 45.6 and is prone to an unspecified vulnerability. A flaw is present in the applications, which fail to properly validate the origin of events. Successful exploitation allows content from other origins to fire events and inject content and commands into the Pocket context.