CVE-2009-1307: Mozilla Firefox

Medium severity, CVSS 6.8. EPSS: 2.2% chance of exploitation in the next 30 days.

The view-source: URI implementation in Mozilla Firefox before 3.0.9, Thunderbird, and SeaMonkey does not properly implement the Same Origin Policy, which allows remote attackers to (1) bypass crossdomain.xml restrictions and connect to arbitrary web sites via a Flash file; (2) read, create, or modify Local Shared Objects via a Flash file; or (3) bypass unspecified restrictions and render content via vectors involving a jar: URI.

Affected products

• Mozilla Firefox: up to and including 3.0.8; version 0.1 only; version 0.2 only; version 0.3 only; version 0.4 only; version 0.5 only; …
• Mozilla Seamonkey: any version
• Mozilla Thunderbird: any version

Published 2009-04-22. Last modified 2026-06-16.