Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
2.6

Firefox, Mozilla, Netscape Java plugin can spoof other tabs

CVE-2004-1753 · published 21 years ago
Summary

On Mac OS X, the Java plugin used by older versions of Firefox, Mozilla and Netscape does not correctly stop a Java applet in one browser tab from drawing in other tabs when tabbed browsing is on. This can let a malicious applet create fake pages that look like other sites, increasing the risk of phishing. To protect yourself, disable Java in these browsers, turn off tabbed browsing, or upgrade to a newer browser version that no longer uses this plugin.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
mozilla firefox 0.9.3
cpe:2.3:a:mozilla:firefox:0.9.3:*:*:*:*:*:*:*
mozilla mozilla 1.7.2
cpe:2.3:a:mozilla:mozilla:1.7.2:*:*:*:*:*:*:*
netscape navigator 7.1
7.2
cpe:2.3:a:netscape:navigator:7.1:*:*:*:*:*:*:*
Original advisory text
The Apple Java plugin, as used in Netscape 7.1 and 7.2, Mozilla 1.7.2, and Firefox 0.9.3 on MacOS X 10.3.5, when tabbed browsing is enabled, does not properly handle SetWindow(NULL) calls, which al...
The Apple Java plugin, as used in Netscape 7.1 and 7.2, Mozilla 1.7.2, and Firefox 0.9.3 on MacOS X 10.3.5, when tabbed browsing is enabled, does not properly handle SetWindow(NULL) calls, which allows Java applets from one tab to draw to other tabs and facilitates phishing attacks that spoof tabs.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker partial control (estimated)
Severity
2.6 Low
Exploitation
2% chance of attack within 30 days
Timeline
Published31 Dec 2004
Updated3 Nov 2026
First seen29 Sep 2026
Sources
CVE-2004-1753 · NVD
Track software like this
Free during beta