Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
6.4

Firefox, Thunderbird, SeaMonkey can let web pages fake UI

CVE-2012-0460 · published 14 years ago
Summary

Versions of Firefox (4‑10), Firefox ESR before 10.0.3, Thunderbird (5‑10), Thunderbird ESR before 10.0.3, and SeaMonkey before 2.8 let a malicious web page change the full‑screen window object. This can make the browser display fake buttons or dialogs, tricking users into taking unwanted actions. Upgrade to the latest releases or apply the security patches provided by Mozilla to stop this behavior.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
mozilla firefox 4.0
4.0.1
5.0
5.0.1
6.0
6.0.1
6.0.2
7.0
7.0.1
8.0
8.0.1
9.0
2 more version ranges
cpe:2.3:a:mozilla:firefox:4.0:*:*:*:*:*:*:*
mozilla firefox_esr 10.1
10.2
cpe:2.3:a:mozilla:firefox_esr:10.1:*:*:*:*:*:*:*
mozilla thunderbird 5.0
6.0
6.0.1
6.0.2
7.0
7.0.1
8.0
9.0
9.0.1
cpe:2.3:a:mozilla:thunderbird:5.0:*:*:*:*:*:*:*
mozilla thunderbird_esr 10.0
10.0.1
10.0.2
cpe:2.3:a:mozilla:thunderbird_esr:10.0:*:*:*:*:*:*:*
mozilla seamonkey <= 2.7
1.0
1.0.1
1.0.2
1.0.3
1.0.4
1.0.5
1.0.6
1.0.7
1.0.8
1.0.9
1.1
49 more version ranges
cpe:2.3:a:mozilla:seamonkey:*:beta5:*:*:*:*:*:*
Original advisory text
Mozilla Firefox 4.x through 10.0, Firefox ESR 10.x before 10.0.3, Thunderbird 5.0 through 10.0, Thunderbird ESR 10.x before 10.0.3, and SeaMonkey before 2.8 do not properly restrict write access to...
Mozilla Firefox 4.x through 10.0, Firefox ESR 10.x before 10.0.3, Thunderbird 5.0 through 10.0, Thunderbird ESR 10.x before 10.0.3, and SeaMonkey before 2.8 do not properly restrict write access to the window.fullScreen object, which allows remote attackers to spoof the user interface via a crafted web page.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
6.4 Medium
Exploitation
2% chance of attack within 30 days
Type
CWE-264Permissions, Privileges, and Access Controls
Timeline
Published14 Mar 2012
Updated3 Nov 2026
First seen29 Sep 2026
Sources
CVE-2012-0460 · NVD
Track software like this
Free during beta