Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
2.6

Firefox 3 (pre‑3.0.6) can be tricked to read other pages

CVE-2009-0354 · published 17 years ago
Summary

Firefox 3 versions before 3.0.6 contain a flaw that lets a malicious website bypass the browser’s built‑in protection that normally keeps each site separate. An attacker could view data from other sites open in the browser and inject their own code. Upgrade Firefox to version 3.0.6 or later (or apply the official patch) to restore proper site isolation.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
mozilla firefox 3.0
3.0.1
3.0.2
3.0.3
3.0.4
3.0.5
cpe:2.3:a:mozilla:firefox:3.0:*:*:*:*:*:*:*
Original advisory text
Cross-domain vulnerability in js/src/jsobj.cpp in Mozilla Firefox 3.x before 3.0.6 allows remote attackers to bypass the Same Origin Policy, and access the properties of an arbitrary window and con...
Cross-domain vulnerability in js/src/jsobj.cpp in Mozilla Firefox 3.x before 3.0.6 allows remote attackers to bypass the Same Origin Policy, and access the properties of an arbitrary window and conduct cross-site scripting (XSS) attacks, via vectors involving a chrome XBL method and the window.eval function.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker partial control (estimated)
Severity
2.6 Low
Exploitation
2% chance of attack within 30 days
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published4 Feb 2009
Updated29 Oct 2026
First seen29 Sep 2026
Sources
CVE-2009-0354 · NVD
Track software like this
Free during beta