CVE-2010-0176: Mozilla Firefox

High severity, CVSS 9.3. EPSS: 5.2% chance of exploitation in the next 30 days.

Mozilla Firefox before 3.0.19, 3.5.x before 3.5.9, and 3.6.x before 3.6.2; Thunderbird before 3.0.4; and SeaMonkey before 2.0.4 do not properly manage reference counts for option elements in a XUL tree optgroup, which might allow remote attackers to execute arbitrary code via unspecified vectors that trigger access to deleted elements, related to a "dangling pointer vulnerability."

Affected products

• Mozilla Firefox: version 3.6 only; up to and including 3.5.7; version 0.1 only; version 0.2 only; version 0.3 only; version 0.4 only; …
• Mozilla Seamonkey: up to and including 2.0.3; version 1.0 only; version 1.0.1 only; version 1.0.2 only; version 1.0.3 only; version 1.0.4 only; …
• Mozilla Thunderbird: up to and including 3.0.3; version 0.1 only; version 0.2 only; version 0.3 only; version 0.4 only; version 0.5 only; …

Published 2010-04-05. Last modified 2026-06-16.