CVE-2011-2362: Mozilla Firefox

Medium severity, CVSS 5.0. EPSS: 1.8% chance of exploitation in the next 30 days.

Mozilla Firefox before 3.6.18, Thunderbird before 3.1.11, and SeaMonkey through 2.0.14 do not distinguish between cookies for two domain names that differ only in a trailing dot, which allows remote web servers to bypass the Same Origin Policy via Set-Cookie headers.

Affected products

• Mozilla Firefox: up to and including 3.6.17; version 1.0 only; version 1.0.1 only; version 1.0.2 only; version 1.0.3 only; version 1.0.4 only; …
• Mozilla Seamonkey: version 1.0 only; version 1.0.1 only; version 1.0.2 only; version 1.0.3 only; version 1.0.4 only; version 1.0.5 only; …
• Mozilla Thunderbird: up to and including 3.1.10; version 0.1 only; version 0.2 only; version 0.3 only; version 0.4 only; version 0.5 only; …

Published 2011-06-30. Last modified 2026-06-16.