VULNERABILITY INTELLIGENCE

CVE-2009-1840

CVSS score9.3 HIGH
EPSS probability2.22%
CISA KEVNot currently listed
Published2009-06-12
Last modified2026-06-16
CVSS vectorAV:N/AC:M/Au:N/C:C/I:C/A:C

Description

Mozilla Firefox before 3.0.11, Thunderbird, and SeaMonkey do not check content policy before loading a script file into a XUL document, which allows remote attackers to bypass intended access restrictions via a crafted HTML document, as demonstrated by a "web bug" in an e-mail message, or web script or an advertisement in a web page.

Primary references