VULNERABILITY INTELLIGENCE

CVE-2009-1838

CVSS score9.3 NONE
EPSS probability4.79%
CISA KEVNot currently listed
Published2009-06-12
Last modified2026-06-16
CVSS vectorAV:N/AC:M/Au:N/C:C/I:C/A:C

Description

The garbage-collection implementation in Mozilla Firefox before 3.0.11, Thunderbird before 2.0.0.22, and SeaMonkey before 1.1.17 sets an element's owner document to null in unspecified circumstances, which allows remote attackers to execute arbitrary JavaScript with chrome privileges via a crafted event handler, related to an incorrect context for this event handler.

Weakness classification

  • nvd@nist.gov: CWE-94

Primary references