CVE-2016-2832

Vulnerability

In Mozilla Firefox versions prior to 47.0, the CSS pseudo-class :-moz-handler-disabled (and related pseudo-classes) can be used by web content to determine whether a specific plugin is installed but disabled [2][3]. This allows a remote attacker to enumerate the complete list of plugins on a user's system, even those that are disabled. The vulnerability resides in the CSS parsing and computation engine, where the state of plugins is exposed through CSS selector matching.

Exploitation

An attacker can exploit this vulnerability by crafting a malicious webpage that includes CSS rules targeting the :-moz-handler-disabled pseudo-class for various known plugin identifiers. When a user visits the page, the browser evaluates the CSS selectors and reveals which plugins are present but disabled. No authentication or special privileges are required; the attacker only needs to lure the user to the crafted page.

Impact

Successful exploitation results in information disclosure: the attacker learns the set of plugins installed on the victim's system, including those that are disabled. This information can be used for browser fingerprinting and to tailor further attacks based on the known plugin set.

Mitigation

The vulnerability is fixed in Firefox 47.0, released on June 7, 2016 [3]. Users should update to Firefox 47 or later. No workaround is available for earlier versions. The issue is not known to be exploited in the wild and is not listed on the CISA Known Exploited Vulnerabilities catalog.