CVE-2010-3771: Mozilla Firefox

Medium severity, CVSS 6.8. EPSS: 2.3% chance of exploitation in the next 30 days.

Mozilla Firefox before 3.5.16 and 3.6.x before 3.6.13, and SeaMonkey before 2.0.11, does not properly handle injection of an ISINDEX element into an about:blank page, which allows remote attackers to execute arbitrary JavaScript code with chrome privileges via vectors related to redirection to a chrome: URI.

Affected products

• Mozilla Firefox: version 3.6 only; version 3.6.2 only; version 3.6.3 only; version 3.6.4 only; version 3.6.6 only; version 3.6.7 only; …
• Mozilla Seamonkey: up to and including 2.0.10; version 1.0 only; version 1.0.1 only; version 1.0.2 only; version 1.0.3 only; version 1.0.4 only; …

Published 2010-12-10. Last modified 2026-06-16.