CVE-2011-3647: Mozilla Firefox

High severity, CVSS 9.3. EPSS: 1.9% chance of exploitation in the next 30 days.

The JSSubScriptLoader in Mozilla Firefox before 3.6.24 and Thunderbird before 3.1.6 does not properly handle XPCNativeWrappers during calls to the loadSubScript method in an add-on, which makes it easier for remote attackers to gain privileges via a crafted web site that leverages certain unwrapping behavior, a related issue to CVE-2011-3004.

Affected products

• Mozilla Firefox: up to and including 3.6.23; version 0.1 only; version 0.2 only; version 0.3 only; version 0.4 only; version 0.5 only; …
• Mozilla Thunderbird: up to and including 3.1.5; version 0.1 only; version 0.2 only; version 0.3 only; version 0.4 only; version 0.5 only; …

Published 2011-11-09. Last modified 2026-06-16.