# CVE-1999-0142: Netscape Navigator and JDK Security Manager restriction bypass

Source: https://junglewise.ai/threats/cve-1999-0142-netscape-navigator-and-jdk-security-manager-restriction-bypass  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 1996-03-01. Updated: 2026-05-10  
License: CC BY 4.0 with a link back

CVE-1999-0142 · Severity: high · CVSS 7.5 · Published 1996-03-01

A security flaw in early versions of Netscape Navigator and the Java Developer's Kit allows malicious web-based programs (applets) to bypass security restrictions. Normally, these programs are restricted to communicating only with the server they originated from; however, this bug allows them to connect to any computer on a network. This could be used by an attacker to scan internal networks or bypass firewalls using a victim's browser as a jumping-off point.

Technologies: [Netscape Navigator](https://junglewise.ai/threats/technologies/navigator). Vendors: [Netscape](https://junglewise.ai/threats/vendors/netscape), [Sun](https://junglewise.ai/threats/vendors/sun), [Sun Microsystems](https://junglewise.ai/threats/vendors/sun-microsystems).

## Quick answers

**Is CVE-1999-0142 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-1999-0142 being exploited in the wild.

**How severe is CVE-1999-0142?** High severity, with a CVSS score of 7.5, published 1 March 1996.

**Which products and versions are affected?** Sun Microsystems Java Developer's Kit 1.0.

**Is there a fix for CVE-1999-0142?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-1999-0142 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-1999-0142?** Check whether you run Netscape Navigator, Sun Java or Sun Microsystems Java Developer's Kit at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A vulnerability exists in the Java Applet Security Manager implementation within Netscape Navigator 2.0 and JDK 1.0. The Security Manager fails to properly enforce the 'same-origin policy' for network connections, which is intended to restrict an applet's socket communications to its host of origin. By exploiting this flaw, a remote attacker can deliver a malicious applet that, once executed in the victim's browser, establishes unauthorized connections to arbitrary IP addresses and ports. This allows for internal network reconnaissance, port scanning, and potential exploitation of other services behind a firewall that would otherwise be unreachable from the public internet.

## Affected products

- Netscape Navigator 2.0
- Sun Microsystems Java Developer's Kit 1.0

## Timeline

- 1996-03-01: disclosed: Initial publication date

## References

- [https://exchange.xforce.ibmcloud.com/vulnerabilities/CVE-1999-0142](https://exchange.xforce.ibmcloud.com/vulnerabilities/CVE-1999-0142)

## Related threats

- [Netscape Navigator Java security model bypass](https://junglewise.ai/threats/cve-1999-1262-netscape-navigator-java-security-model-bypass)
- [Microsoft Internet Explorer and Netscape Navigator information disclosure via JavaScript](https://junglewise.ai/threats/cve-1999-0031-microsoft-internet-explorer-and-netscape-navigator-information)
- [Sun Microsystems Java arbitrary command execution in Bytecode Verifier](https://junglewise.ai/threats/cve-1999-0141-sun-microsystems-java-arbitrary-command-execution-in-bytecode)