# CVE-2017-7820: firefox: The "instanceof" operator can bypass the Xray wrapper mechanism

CVE-2017-7820 is fixed in 4 products on 1 platform, first by firefox 56.0+build6-0ubuntu1, released October 1, 2017. It is not reported as exploited. Patch Radar priority: Routine.

- Web page: https://patchblox.com/security/cve/CVE-2017-7820
- Priority: Routine
- CVSS: n/a (Low)
- EPSS: 0.0116
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Oct 1, 2017

## Description

The "instanceof" operator can bypass the Xray wrapper mechanism. When called on web content from the browser itself or an extension the web content can provide its own result for that operator, possibly tricking the browser or extension into mishandling the element. This vulnerability affects Firefox < 56.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | firefox Ubuntu 18.04.6 LTS (bionic) | 56.0+build6-0ubuntu1 | [firefox 56.0+build6-0ubuntu1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-firefox-56.0-build6-0ubuntu1.md) | Oct 1, 2017 |
| Linux | firefox-globalmenu Ubuntu 18.04.6 LTS (bionic) | 56.0+build6-0ubuntu1 | [firefox-globalmenu 56.0+build6-0ubuntu1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-firefox-globalmenu-56.0-build6-0ubuntu1.md) | Oct 1, 2017 |
| Linux | firefox-mozsymbols Ubuntu 18.04.6 LTS (bionic) | 56.0+build6-0ubuntu1 | [firefox-mozsymbols 56.0+build6-0ubuntu1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-firefox-mozsymbols-56.0-build6-0ubuntu1.md) | Oct 1, 2017 |
| Linux | firefox-testsuite Ubuntu 18.04.6 LTS (bionic) | 56.0+build6-0ubuntu1 | [firefox-testsuite 56.0+build6-0ubuntu1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-firefox-testsuite-56.0-build6-0ubuntu1.md) | Oct 1, 2017 |

---

Data as of 2026-11-07T12:40:37Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo