CVE-2007-1970: Mozilla Firefox

Medium severity, CVSS 5.0. EPSS: 0.9% chance of exploitation in the next 30 days.

Mozilla Firefox does not warn the user about HTTP elements on an HTTPS page when the HTTP elements are dynamically created by a delayed document.write, which allows remote attackers to supply unauthenticated content and conduct phishing attacks.

Affected products

• Mozilla Firefox: any version

Published 2007-04-11. Last modified 2026-06-16.