CVE-2009-5017: Mozilla Firefox

Medium severity, CVSS 4.3. EPSS: 1.8% chance of exploitation in the next 30 days.

Mozilla Firefox before 3.6 Beta 3 does not properly handle overlong UTF-8 encoding, which makes it easier for remote attackers to bypass cross-site scripting (XSS) protection mechanisms via a crafted string, a different vulnerability than CVE-2010-1210.

Affected products

• Mozilla Firefox: up to and including 3.6; version 3.6 only

Published 2010-11-12. Last modified 2026-06-16.