When a "javascript:" URL is drag and dropped by a user into the addressbar, the URL will be processed and executed. This allows for users to be socially engineered to execute an XSS attack on themselves. This vulnerability affects Firefox < 53.
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-5458.json"
[ { "events": [ { "introduced": "0" }, { "fixed": "53.0" } ] } ]