CVE-2009-1838: The garbage-collection implementation in Mozilla Firefox before 3.0.11, Thunderbird before 2.0.0.22, and SeaMonkey before 1.1.17 sets an element's owner document to null in…

Unscored severity · published Jun 12, 2009

CVE-2009-1838

The garbage-collection implementation in Mozilla Firefox before 3.0.11, Thunderbird before 2.0.0.22, and SeaMonkey before 1.1.17 sets an element's owner document to null in…

–

CVSS

4.8%

EPSS

On KEV

Description

The garbage-collection implementation in Mozilla Firefox before 3.0.11, Thunderbird before 2.0.0.22, and SeaMonkey before 1.1.17 sets an element's owner document to null in unspecified circumstances, which allows remote attackers to execute arbitrary JavaScript with chrome privileges via a crafted event handler, related to an incorrect context for this event handler.

Exploitation

Is it being used?

Exploit prediction (EPSS)4.8% · higher than 92% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

Firefox · Mozilla

through 3.0.10; 0.1; 0.2; 0.3; 0.4; 0.5; +34 more · source: NVD

Seamonkey · Mozilla

through 1.1.16; 1.0; 1.0; 1.0; 1.0; 1.0; +24 more · source: NVD