$ cve CVE-2013-0757 JSON

CVE-2013-0757 EXPLOIT

9.3

HIGH · CVSS 2.0 · EPSS 60.9% (pctl 99)

Patch early

A public exploit exists.

Description

The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderbird ESR 17.x before 17.0.2, and SeaMonkey before 2.15 does not prevent modifications to the prototype of an object, which allows remote attackers to execute arbitrary JavaScript code with chrome privileges by referencing Object.prototype.__proto__ in a crafted HTML document.

Scoring

CVSS	9.3 (HIGH, v2.0)
Vector	AV:N/AC:M/Au:N/C:C/I:C/A:C
EPSS	60.86% — more likely to be exploited than 99% of all CVEs
Weakness	CWE-20
On CISA KEV	no
Public exploit	yes
Published	2013-01-13
Last modified	2026-06-16

Affected (9)

Vendor	Product
canonical	ubuntu linux
mozilla	firefox
mozilla	seamonkey
mozilla	thunderbird
mozilla	thunderbird esr
opensuse	opensuse
suse	linux enterprise desktop
suse	linux enterprise server
suse	linux enterprise software development kit

Public exploits

Source	Title	Date
exploit-db	GIT 1.8.5.6/1.9.5/2.0.5/2.1.4/2.2.1 & Mercurial < 3.2.3 - Multiple Vulnerabilities (Metasploit)	2014-12-18
exploit-db	Mozilla Firefox < 17.0.1 - Flash Privileged Code Injection (Metasploit)	2013-01-08

References

→ the Explorer · watch your stack · NVD