CVE-2009-2665

no score yetEPSS 2.5%

mozilla firefox: no CVSS score yet. EPSS 2.5% chance of exploitation in the next 30 days.

The nsDocument::SetScriptGlobalObject function in content/base/src/nsDocument.cpp in Mozilla Firefox 3.5.x before 3.5.2, when certain add-ons are enabled, does not properly handle a Link HTTP header, which allows remote attackers to execute arbitrary JavaScript with chrome privileges via a crafted web page, related to an incorrect security wrapper.

EPSS: 2.5% chance of exploitation in the next 30 days; higher than 84% of CVEs (scores of 2026-10-31)
CWE: CWE-94
Published: 2009-08-04
Modified: 2026-06-16
Record from: the NVD, synced 2026-10-19

Affected

mozilla:firefox

References

http://secunia.com/advisories/36126
http://sunsolve.sun.com/search/document.do?assetkey=1-66-266148-1
http://www.mozilla.org/security/announce/2009/mfsa2009-46.html
http://www.securityfocus.com/bid/35928
http://www.vupen.com/english/advisories/2009/2142

Check your stack JSON