CVE-2009-2975: Mozilla Firefox

Medium severity, CVSS 5.0. EPSS: 2.1% chance of exploitation in the next 30 days.

Mozilla Firefox 3.5.2 on Windows XP, in some situations possibly involving an incompletely configured protocol handler, does not properly implement setting the document.location property to a value specifying a protocol associated with an external application, which allows remote attackers to cause a denial of service (memory consumption) via vectors involving a series of function calls that set this property, as demonstrated by (1) the chromehtml: protocol and (2) the aim: protocol.

Affected products

• Mozilla Firefox: version 3.5.2 only

Published 2009-08-27. Last modified 2026-06-16.