- December 19, 2006
- Firefox, SeaMonkey, Thunderbird
- Fixed in
- Firefox 126.96.36.199
- Firefox 188.8.131.52
- SeaMonkey 1.0.7
- Thunderbird 184.108.40.206
moz_bug_r_a4 reported that the
src attribute of an
to bypass the protections against cross-site script (XSS) injection.
The injected script could steal credentials and financial data, or perform
destructive actions on behalf of a logged-in user.
Exploit details withheld until after the active update period.