CVE-2011-2981

no score yetEPSS 2.3%

The event-management implementation in Mozilla Firefox before 3.6.20, SeaMonkey 2.x, Thunderbird 3.x before 3.1.12, and possibly other products does not properly select the context for script to run in, which allows remote attackers to bypass the Same Origin Policy or execute arbitrary JavaScript code with chrome privileges via a crafted web site.

EPSS: 2.3% chance of exploitation in the next 30 days; higher than 82% of CVEs (scores of 2026-10-31)
CWE: CWE-16
Published: 2011-08-18
Modified: 2026-06-16
Record from: the NVD, synced 2026-10-19

Affected

mozilla:firefox
mozilla:seamonkey
mozilla:thunderbird

References

http://lists.opensuse.org/opensuse-security-announce/2011-08/msg00023.html
http://lists.opensuse.org/opensuse-security-announce/2011-08/msg00027.html
http://www.debian.org/security/2011/dsa-2295
http://www.debian.org/security/2011/dsa-2296
http://www.debian.org/security/2011/dsa-2297

Check your stack JSON