The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderbird ESR 17.x before 17.0.2, and SeaMonkey before 2.15 does not prevent modifications to the prototype of an object, which allows remote attackers to execute arbitrary JavaScript code with chrome privileges by referencing Object.prototype.__proto__ in a crafted HTML document.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Freebsd | — | Upgrade firefoxUpgrade linux-thunderbirdUpgrade thunderbirdUpgrade ca_root_nssUpgrade seamonkeyUpgrade linux-firefoxUpgrade linux-seamonkeyUpgrade libxul | Dec 10, 2025 | Jan 9, 2013 |
| Gentoo Linux | — | Upgrade www-client/firefox.Upgrade mail-client/thunderbird.Upgrade www-client/firefox-bin.Upgrade www-client/seamonkey.Upgrade mail-client/thunderbird-bin.Upgrade www-client/seamonkey-bin. | Oct 30, 2017 | Jan 13, 2013 |
| Mfsa2013 14 | — | Upgrade to Mozilla Firefox ESR version 17.0.2Upgrade to Mozilla Firefox version 18.0Upgrade to the latest version of Mozilla Firefox | Nov 21, 2013 | Jan 13, 2013 |
| Mozilla Seamonkey | — | Upgrade to Mozilla SeaMonkey version 2.15.0 | Nov 21, 2013 | Jan 13, 2013 |
| Mozilla Thunderbird | — | Upgrade to Mozilla Thunderbird ESR version 17.0.2Upgrade to Mozilla Thunderbird version 17.0.2Upgrade to the latest version of Mozilla Thunderbird | Nov 21, 2013 | Jan 13, 2013 |
| Suse | — | Upgrade seamonkey-ircUpgrade mozilla-nss-sysinit-32bitUpgrade mozilla-nss-certs-32bitUpgrade seamonkey-dom-inspectorUpgrade mozilla-nss-debuginfo-x86Upgrade mozilla-js-debuginfo-x86Upgrade mozilla-nss-develUpgrade mozilla-nss-certs-debuginfoUpgrade firefox3-cairoUpgrade mozilla-js-32bitUpgrade seamonkey-translations-otherUpgrade mozilla-nss-sysinit-debuginfo-x86Upgrade mozilla-nspr-debuginfo-32bitUpgrade mozilla-nss-debuginfoUpgrade MozillaFirefox-debuginfoUpgrade mozilla-nss-x86Upgrade seamonkey-translations-commonUpgrade seamonkey-debuginfoUpgrade libsoftokn3-32bitUpgrade xulrunner-debuginfo-x86Upgrade mozilla-nspr-debuginfo-x86Upgrade libfreebl3-debuginfo-x86Upgrade libsoftokn3-x86Upgrade mozilla-nss-toolsUpgrade mozilla-nss-certs-debuginfo-x86Upgrade mozilla-js-debuginfo-32bitUpgrade libfreebl3-32bitUpgrade libsoftokn3-debuginfo-x86Upgrade mozilla-nss-32bitUpgrade firefox3-gtk2Upgrade MozillaFirefoxUpgrade mozilla-nss-certs-x86Upgrade xulrunner-debuginfo-32bitUpgrade xulrunner-develUpgrade libfreebl3-debuginfoUpgrade MozillaThunderbird-debugsourceUpgrade MozillaThunderbird-translations-commonUpgrade libsoftokn3Upgrade enigmailUpgrade mozilla-js-debuginfoUpgrade mozilla-nss-sysinit-debuginfoUpgrade firefox3-gtk2-32bitUpgrade mozilla-nspr-x86Upgrade MozillaFirefox-translationsUpgrade firefox3-pango-32bitUpgrade MozillaFirefox-translations-commonUpgrade libsoftokn3-debuginfoUpgrade mozilla-js-x86Upgrade mozilla-jsUpgrade mozilla-nss-64bitUpgrade xulrunner-buildsymbolsUpgrade xulrunner-debugsourceUpgrade mozilla-nspr-debugsourceUpgrade xulrunner-32bitUpgrade xulrunner-debuginfoUpgrade mozilla-nss-sysinit-debuginfo-32bitUpgrade mozilla-nss-debugsourceUpgrade MozillaFirefox-translations-otherUpgrade MozillaThunderbird-devel-debuginfoUpgrade MozillaThunderbird-translations-otherUpgrade mozilla-nss-tools-debuginfoUpgrade MozillaThunderbird-buildsymbolsUpgrade MozillaFirefox-branding-SLEDUpgrade mozilla-nspr-32bitUpgrade MozillaThunderbird-develUpgrade seamonkey-debugsourceUpgrade mozilla-nssUpgrade xulrunner-x86Upgrade firefox3-pangoUpgrade xulrunnerUpgrade libfreebl3Upgrade mozilla-nss-certsUpgrade enigmail-debuginfoUpgrade mozilla-nspr-debuginfoUpgrade mozillafirefox-buildsymbolsUpgrade MozillaFirefox-develUpgrade mozilla-nspr-develUpgrade mozilla-nss-sysinitUpgrade firefox3-cairo-32bitUpgrade MozillaThunderbirdUpgrade seamonkeyUpgrade mozilla-nsprUpgrade MozillaFirefox-debugsourceUpgrade mozilla-nss-certs-debuginfo-32bitUpgrade MozillaThunderbird-debuginfoUpgrade libfreebl3-x86Upgrade seamonkey-venkmanUpgrade libsoftokn3-debuginfo-32bitUpgrade xulrunner-devel-debuginfoUpgrade mozilla-nspr-64bitUpgrade sle-sdk-releaseUpgrade mozilla-nss-sysinit-x86Upgrade mozillafirefox-branding-upstreamUpgrade libfreebl3-debuginfo-32bitUpgrade mozilla-nss-debuginfo-32bit | Feb 17, 2015 | Jan 13, 2013 |
| Ubuntu | — | Upgrade thunderbirdUpgrade firefox | Nov 8, 2024 | Jan 13, 2013 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub