CVE-2006-2779: Mozilla Firefox

High severity, CVSS 9.3. EPSS: 7% chance of exploitation in the next 30 days.

Mozilla Firefox and Thunderbird before 1.5.0.4 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via (1) nested <option> tags in a select tag, (2) a DOMNodeRemoved mutation event, (3) "Content-implemented tree views," (4) BoxObjects, (5) the XBL implementation, (6) an iframe that attempts to remove itself, which leads to memory corruption.

Affected products

• Mozilla Firefox: version 0.8 only; version 0.9 only; version 0.9.1 only; version 0.9.2 only; version 0.9.3 only; version 0.10 only; …
• Mozilla Thunderbird: version 0.6 only; version 0.7 only; version 0.7.1 only; version 0.7.2 only; version 0.7.3 only; version 0.8 only; …

Published 2006-06-02. Last modified 2026-06-16.