CVE-2007-0780: Canonical Ubuntu Linux

Medium severity, CVSS 6.8. EPSS: 2.6% chance of exploitation in the next 30 days.

browser.js in Mozilla Firefox 1.5.x before 1.5.0.10 and 2.x before 2.0.0.2, and SeaMonkey before 1.0.8 uses the requesting URI to identify child windows, which allows remote attackers to conduct cross-site scripting (XSS) attacks by opening a blocked popup originating from a javascript: URI in combination with multiple frames having the same data: URI.

Affected products

• Canonical Ubuntu Linux: version 5.10 only; version 6.06 only; version 6.10 only
• Mozilla Firefox: from 1.5, before 1.5.0.10 (fixed in 1.5.0.10); from 2.0, before 2.0.0.2 (fixed in 2.0.0.2)
• Mozilla Seamonkey: before 1.0.8 (fixed in 1.0.8)

Published 2007-02-26. Last modified 2026-06-16.