An issue where a "" dropdown menu can be used to cover location bar content, resulting in potential spoofing attacks. This attack requires e10s to be enabled in order to function. This vulnerability affects Firefox < 50.

CVSS Score and Metrics +CVSS Score and Metrics -

CVSS V3 Severity:		CVSS V2 Severity:
CVSS Score : 5.9		CVSS Score : 4.3
Exploit Score: 2.2		Exploit Score: 8.6
Impact Score: 3.6		Impact Score: 2.9
CVSS V3 Metrics:		CVSS V2 Metrics:
Attack Vector: NETWORK		Access Vector: NETWORK
Attack Complexity: HIGH		Access Complexity: MEDIUM
Privileges Required: NONE		Authentication: NONE
User Interaction: NONE		Confidentiality: NONE
Scope: UNCHANGED		Integrity: PARTIAL
Confidentiality: NONE		Availability: NONE
Integrity: HIGH
Availability: NONE

Reference:

SECTRACK-1037298

BID-94337

https://bugzilla.mozilla.org/show_bug.cgi?id=1276976

https://www.mozilla.org/security/advisories/mfsa2016-89/