CVE-2011-3004: Mozilla Firefox

Medium severity, CVSS 4.3. EPSS: 1.1% chance of exploitation in the next 30 days.

The JSSubScriptLoader in Mozilla Firefox 4.x through 6 and SeaMonkey before 2.4 does not properly handle XPCNativeWrappers during calls to the loadSubScript method in an add-on, which makes it easier for remote attackers to gain privileges via a crafted web site that leverages certain unwrapping behavior.

Affected products

• Mozilla Firefox: version 4.0 only; version 4.0.1 only; version 5.0 only; version 6.0 only
• Mozilla Seamonkey: up to and including 2.3.3; version 1.0 only; version 1.0.1 only; version 1.0.2 only; version 1.0.3 only; version 1.0.4 only; …

Published 2011-09-29. Last modified 2026-06-16.