CVE-2009-0354

no score yetEPSS 2.3%

mozilla firefox: no CVSS score yet. EPSS 2.3% chance of exploitation in the next 30 days.

Cross-domain vulnerability in js/src/jsobj.cpp in Mozilla Firefox 3.x before 3.0.6 allows remote attackers to bypass the Same Origin Policy, and access the properties of an arbitrary window and conduct cross-site scripting (XSS) attacks, via vectors involving a chrome XBL method and the window.eval function.

EPSS: 2.3% chance of exploitation in the next 30 days; higher than 83% of CVEs (scores of 2026-10-31)
CWE: CWE-79
Published: 2009-02-04
Modified: 2026-06-16
Record from: the NVD, synced 2026-10-19

Affected

mozilla:firefox

References

http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00001.html
http://rhn.redhat.com/errata/RHSA-2009-0256.html
http://secunia.com/advisories/33799
http://secunia.com/advisories/33809
http://secunia.com/advisories/33831

Check your stack JSON