CVE-2007-3736: Mozilla Firefox

Medium severity, CVSS 4.3. EPSS: 1.3% chance of exploitation in the next 30 days.

Cross-site scripting (XSS) vulnerability in Mozilla Firefox before 2.0.0.5 allows remote attackers to inject arbitrary web script "into another site's context" via a "timing issue" involving the (1) addEventListener or (2) setTimeout function, probably by setting events that activate after the context has changed.

Affected products

• Mozilla Firefox: version 2.0 only; version 2.0.0.1 only; version 2.0.0.2 only; version 2.0.0.3 only; version 2.0.0.4 only

Published 2007-07-18. Last modified 2026-06-16.