CVE-2010-3765: Mozilla Multiple Products memory corruption in nsCSSFrameConstructor

CVE-2010-3765 · Severity: critical · CVSS 9.8 · Exploited in the wild · Published 2025-10-06

Mozilla Firefox, Thunderbird, and SeaMonkey are popular web browsers and email clients. A critical vulnerability allows an attacker to take complete control of a user's computer if they visit a malicious website or view a specially crafted email while JavaScript is enabled. This flaw has been actively exploited in the wild to install malware.

Technologies: Apple Multiple Products, Mozilla Firefox, Mozilla Thunderbird. Vendors: Apple, Mozilla.

Quick answers

Is CVE-2010-3765 exploited in the wild?
Yes. CVE-2010-3765 is known to be exploited in the wild, first recorded on 6 October 2025. Treat it as urgent.
How severe is CVE-2010-3765?
Critical severity, with a CVSS score of 9.8, published 6 October 2025.
Which products and versions are affected?
Mozilla Firefox 3.5.x through 3.5.14, 3.6.x through 3.6.11; Mozilla SeaMonkey 2.x before 2.0.10; Mozilla Thunderbird 3.1.6 before 3.1.6, 3.0.x before 3.0.10.
Is there a fix for CVE-2010-3765?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2010-3765 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2010-3765?
Check whether you run Apple Multiple Products, Mozilla Firefox, Mozilla SeaMonkey or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A memory corruption vulnerability exists in Mozilla products due to incorrect index tracking within the nsCSSFrameConstructor::ContentAppended function. When JavaScript is enabled, an attacker can trigger this flaw using the appendChild method and the creation of multiple frames to cause a buffer overflow or similar memory corruption. This allows for remote code execution (RCE) without user interaction beyond visiting a malicious page. The vulnerability was notably exploited in the wild by the Belmoo malware. Patches were released in late 2010 for the affected versions.

Affected products

  • Mozilla Firefox 3.5.x through 3.5.14, 3.6.x through 3.6.11
  • Mozilla Thunderbird 3.1.6 before 3.1.6, 3.0.x before 3.0.10
  • Mozilla SeaMonkey 2.x before 2.0.10

Timeline

  • 2010-10-26: advisory: Mozilla security blog post published
  • 2010-10-27: exploited: Exploited in the wild by Belmoo malware
  • 2025-10-06: kev added: Added to CISA Known Exploited Vulnerabilities catalog

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.