CVE-2012-3993

no score yetEPSS 43%

The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey before 2.13 does not properly interact with failures of InstallTrigger methods, which allows remote attackers to execute arbitrary JavaScript code with chrome privileges via a crafted web site, related to an "XrayWrapper pollution" issue.

EPSS: 43% chance of exploitation in the next 30 days; higher than 98% of CVEs (scores of 2026-10-31)
CWE: CWE-269
Published: 2012-10-10
Modified: 2026-06-16
Record from: the NVD, synced 2026-10-19

Affected

mozilla:firefox
mozilla:seamonkey
mozilla:thunderbird
mozilla:thunderbird_esr

References

http://lists.opensuse.org/opensuse-security-announce/2012-10/msg00010.html
http://osvdb.org/86111
http://rhn.redhat.com/errata/RHSA-2012-1351.html
http://secunia.com/advisories/50856
http://secunia.com/advisories/50892

Check your stack JSON