CVE-2008-3198: Mozilla Firefox

High severity, CVSS 7.5. EPSS: 3% chance of exploitation in the next 30 days.

Mozilla Firefox 3.x before 3.0.1 allows remote attackers to inject arbitrary web script into a chrome document via unspecified vectors, as demonstrated by injection into a XUL error page. NOTE: this can be leveraged to execute arbitrary code using CVE-2008-2933.

Affected products

• Mozilla Firefox: version 3.0 only

Published 2008-07-17. Last modified 2026-06-16.