VULNERABILITY INTELLIGENCE

CVE-2007-0994

CVSS score6.8 MEDIUM
EPSS probability3.31%
CISA KEVNot currently listed
Published2007-03-06
Last modified2026-06-16
CVSS vectorAV:N/AC:M/Au:N/C:P/I:P/A:P

Description

A regression error in Mozilla Firefox 2.x before 2.0.0.2 and 1.x before 1.5.0.10, and SeaMonkey 1.1 before 1.1.1 and 1.0 before 1.0.8, allows remote attackers to execute arbitrary JavaScript as the user via an HTML mail message with a javascript: URI in an (1) img, (2) link, or (3) style tag, which bypasses the access checks and executes code with chrome privileges.

Weakness classification

  • CWE-94: Improper Control of Generation of Code ('Code Injection')

Primary references