CVE-2007-1095

Severity: medium (CVSS 6.8 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2007-02-26 · updated 2026-06-16

Description

Mozilla Firefox before 2.0.0.8 and SeaMonkey before 1.1.5 do not properly implement JavaScript onUnload handlers, which allows remote attackers to run certain JavaScript code and access the location DOM hierarchy in the context of the next web site that is visited by a client.

Affected products

Mozilla Firefox: through 2.0.0.7; 0.1, 0.2, 0.3, 0.4, 0.5, 0.6 (+53)
Mozilla Seamonkey: through 1.1.4; 1.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, 1.0.5 (+8)

References

http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742
http://lcamtuf.coredump.cx/ietrap/ff/
http://lists.grok.org.uk/pipermail/full-disclosure/2007-February/052630.html
http://osvdb.org/33809
http://secunia.com/advisories/27276
http://secunia.com/advisories/27298
http://secunia.com/advisories/27311
http://secunia.com/advisories/27315
http://secunia.com/advisories/27325
http://secunia.com/advisories/27327
http://secunia.com/advisories/27335
http://secunia.com/advisories/27336

Get alerted when CVE-2007-1095 or the next vulnerability affects your stack