CVE-2009-0775: Mozilla Firefox

High severity, CVSS 10.0. EPSS: 4.7% chance of exploitation in the next 30 days.

Double free vulnerability in Mozilla Firefox before 3.0.7, Thunderbird before 2.0.0.21, and SeaMonkey before 1.1.15 allows remote attackers to execute arbitrary code via "cloned XUL DOM elements which were linked as a parent and child," which are not properly handled during garbage collection.

Affected products

• Mozilla Firefox: up to and including 3.0.6; version 1.0 only; version 1.0.1 only; version 1.0.2 only; version 1.0.3 only; version 1.0.4 only; …
• Mozilla Seamonkey: up to and including 1.1.14; version 1.0 only; version 1.0.1 only; version 1.0.2 only; version 1.0.3 only; version 1.0.5 only; …
• Mozilla Thunderbird: up to and including 2.0.0.20; version 2.0.0.0 only; version 2.0.0.4 only; version 2.0.0.5 only; version 2.0.0.6 only; version 2.0.0.9 only; …

Published 2009-03-05. Last modified 2026-06-16.