CVE-2009-1044: Mozilla Firefox

High severity, CVSS 9.3. EPSS: 6.5% chance of exploitation in the next 30 days.

Mozilla Firefox 3.0.7 on Windows 7 allows remote attackers to execute arbitrary code via unknown vectors related to the _moveToEdgeShift XUL tree method, which triggers garbage collection on objects that are still in use, as demonstrated by Nils during a PWN2OWN competition at CanSecWest 2009.

Affected products

• Mozilla Firefox: version 3.0.7 only

Published 2009-03-23. Last modified 2026-06-16.