CVE-2012-4210

Severity: critical (CVSS 9.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2012-11-21 · updated 2026-06-16
Weakness: CWE-264

Description

The Style Inspector in Mozilla Firefox before 17.0 and Firefox ESR 10.x before 10.0.11 does not properly restrict the context of HTML markup and Cascading Style Sheets (CSS) token sequences, which allows user-assisted remote attackers to execute arbitrary JavaScript code with chrome privileges via a crafted stylesheet.

Affected products

Mozilla Firefox: through 16.0.2; 0.1, 0.2, 0.3, 0.4, 0.5, 0.6 (+172)

References

http://lists.opensuse.org/opensuse-security-announce/2012-11/msg00021.html
http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00022.html
http://lists.opensuse.org/opensuse-updates/2012-11/msg00090.html
http://lists.opensuse.org/opensuse-updates/2012-11/msg00093.html
http://rhn.redhat.com/errata/RHSA-2012-1482.html
http://secunia.com/advisories/51359
http://secunia.com/advisories/51369
http://secunia.com/advisories/51434
http://secunia.com/advisories/51439
http://www.mandriva.com/security/advisories?name=MDVSA-2012:173
http://www.mozilla.org/security/announce/2012/mfsa2012-104.html
http://www.palemoon.org/releasenotes-ng.shtml

Get alerted when CVE-2012-4210 or the next vulnerability affects your stack