NetSight
IP …
critical9.8Known exploitedPublic exploit code

CVE-2010-3765

Mozilla Multiple Products Remote Code Execution Vulnerability

Exploited in the wild

This vulnerability is on the CISA Known Exploited Vulnerabilities list, added 2025-10-06. Federal due date: 2025-10-27.

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

Impact

Mozilla Firefox, SeaMonkey, and Thunderbird contain an unspecified vulnerability when JavaScript is enabled. This allows remote attackers to execute arbitrary code via vectors related to nsCSSFrameConstructor::ContentAppended, the appendChild method, incorrect index tracking, and the creation of multiple frames, which triggers memory corruption.

Affected products

VendorProductAffected versions
MozillaFirefox
Versions 3.5, 3.5.1, 3.5.2, 3.5.3, 3.5.4, 3.5.5
MozillaThunderbird
Versions 3.0.1, 3.0.2, 3.0.3, 3.0.4, 3.0.5, 3.0.6
MozillaSeamonkey
Versions 2.0, 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.0.5

Weakness classification

CWE-119

References