ACTIVELY EXPLOITED
CVE-2013-1690: Mozilla Firefox and Thunderbird Denial-of-Service Vulnerability
| Vendor | Mozilla |
|---|---|
| Product | Firefox and Thunderbird |
| Actively exploited | Yes |
| Added to CISA KEV | 28 Mar 2022 |
| CISA federal deadline | 18 Apr 2022 |
| Weakness (CWE) | CWE-119 |
Required action (CISA's text)
Apply updates per vendor instructions.
Description (NVD)
Mozilla Firefox and Thunderbird do not properly handle onreadystatechange events in conjunction with page reloading, which allows remote attackers to cause a denial-of-service (DoS) or possibly execute malicious code via a crafted web site.
SOURCES
Other Mozilla flaws
- CVE-2010-3765: Mozilla Multiple Products Remote Code Execution Vulnerability
- CVE-2024-9680: Mozilla Firefox Use-After-Free Vulnerability
- CVE-2016-9079: Mozilla Firefox, Firefox ESR, and Thunderbird Use-After-Free Vulnerability
- CVE-2015-4495: Mozilla Firefox Security Feature Bypass Vulnerability
- CVE-2019-11708: Mozilla Firefox and Thunderbird Sandbox Escape Vulnerability
Data from NVD, CISA KEV, FIRST EPSS and vendor advisories. Updated 10 Nov 2026.