CVE-2007-5338: Mozilla Firefox

High severity, CVSS 9.3. EPSS: 3.2% chance of exploitation in the next 30 days.

Mozilla Firefox before 2.0.0.8 and SeaMonkey before 1.1.5 allow remote attackers to execute arbitrary Javascript with user privileges by using the Script object to modify XPCNativeWrappers in a way that causes the script to be executed when a chrome action is performed.

Affected products

• Mozilla Firefox: up to and including 2.0.0.7
• Mozilla Seamonkey: up to and including 1.1.4

Published 2007-10-21. Last modified 2026-06-16.