$ cve CVE-2012-3993 JSON

CVE-2012-3993 EXPLOIT

9.3

HIGH · CVSS 2.0 · EPSS 42.6% (pctl 99)

Patch early

A public exploit exists.

Description

The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey before 2.13 does not properly interact with failures of InstallTrigger methods, which allows remote attackers to execute arbitrary JavaScript code with chrome privileges via a crafted web site, related to an "XrayWrapper pollution" issue.

Scoring

CVSS	9.3 (HIGH, v2.0)
Vector	AV:N/AC:M/Au:N/C:C/I:C/A:C
EPSS	42.61% — more likely to be exploited than 99% of all CVEs
Weakness	CWE-269
On CISA KEV	no
Public exploit	yes
Published	2012-10-10
Last modified	2026-06-16

Affected (4)

Vendor	Product
mozilla	firefox
mozilla	seamonkey
mozilla	thunderbird
mozilla	thunderbird esr

Public exploits

Source	Title	Date
exploit-db	Mozilla Firefox 5.0 < 15.0.1 - __exposedProps__ XCS Code Execution (Metasploit)	2013-08-06

References

→ the Explorer · watch your stack · NVD