Executive brief
Mozilla Firefox, Thunderbird, and SeaMonkey are popular web browsers and email clients. A critical vulnerability allows an attacker to take complete control of a user's computer if they visit a malicious website or view a specially crafted email while JavaScript is enabled. This flaw has been actively exploited in the wild to install malware.
Technical details
A memory corruption vulnerability exists in Mozilla products due to incorrect index tracking within the nsCSSFrameConstructor::ContentAppended function. When JavaScript is enabled, an attacker can trigger this flaw using the appendChild method and the creation of multiple frames to cause a buffer overflow or similar memory corruption. This allows for remote code execution (RCE) without user interaction beyond visiting a malicious page. The vulnerability was notably exploited in the wild by the Belmoo malware. Patches were released in late 2010 for the affected versions.
Affected products
- Mozilla Firefox 3.5.x through 3.5.14, 3.6.x through 3.6.11
- Mozilla Thunderbird 3.1.6 before 3.1.6, 3.0.x before 3.0.10
- Mozilla SeaMonkey 2.x before 2.0.10
Timeline
- 2010-10-26: advisory: Mozilla security blog post published
- 2010-10-27: exploited: Exploited in the wild by Belmoo malware
- 2025-10-06: kev added: Added to CISA Known Exploited Vulnerabilities catalog