CVE-2007-2870: Mozilla Firefox

Medium severity, CVSS 4.3. EPSS: 1.6% chance of exploitation in the next 30 days.

Mozilla Firefox 1.5.x before 1.5.0.12 and 2.x before 2.0.0.4, and SeaMonkey 1.0.9 and 1.1.2, allows remote attackers to bypass the same-origin policy and conduct cross-site scripting (XSS) and other attacks by using the addEventListener method to add an event listener for a site, which is executed in the context of that site.

Affected products

• Mozilla Firefox: version 1.5 only; version 1.5.0.1 only; version 1.5.0.2 only; version 1.5.0.3 only; version 1.5.0.4 only; version 1.5.0.5 only; …
• Mozilla Seamonkey: version 1.0.9 only; version 1.1.2 only

Published 2007-06-01. Last modified 2026-06-16.