CVE-2016-2829 (firefox)
Mozilla Firefox before 47.0 allows remote attackers to spoof permission notifications via a crafted web site that rapidly triggers permission requests, as demonstrated by the microphone permission or the geolocation permission.
Source: CVE-2016-2829 (firefox)