CVE-2008-2803: Mozilla Firefox

Medium severity, CVSS 6.8. EPSS: 3.2% chance of exploitation in the next 30 days.

The mozIJSSubScriptLoader.LoadScript function in Mozilla Firefox before 2.0.0.15, Thunderbird 2.0.0.14 and earlier, and SeaMonkey before 1.1.10 does not apply XPCNativeWrappers to scripts loaded from (1) file: URIs, (2) data: URIs, or (3) certain non-canonical chrome: URIs, which allows remote attackers to execute arbitrary code via vectors involving third-party add-ons.

Affected products

• Mozilla Firefox: up to and including 2.0.0.14; version 2.0 only; version 2.0.0.1 only; version 2.0.0.2 only; version 2.0.0.3 only; version 2.0.0.4 only; …
• Mozilla Seamonkey: up to and including 1.1.9; version 1.1 only; version 1.1.2 only; version 1.1.3 only; version 1.1.4 only; version 1.1.5 only; …
• Mozilla Thunderbird: up to and including 2.0.0.14; version 2.0.0.0 only; version 2.0.0.1 only; version 2.0.0.2 only; version 2.0.0.3 only; version 2.0.0.4 only; …

Published 2008-07-07. Last modified 2026-06-16.