{"id":"CVE-2010-3765","published":"2010-10-28T00:00:05Z","modified":"2026-06-16T23:23:28Z","title":"Mozilla Multiple Products Remote Code Execution Vulnerability","vendor":"Mozilla","product":"Multiple Products","tier":"core","eol":null,"description":{"text":"Mozilla Firefox 3.5.x through 3.5.14 and 3.6.x through 3.6.11, Thunderbird 3.1.6 before 3.1.6 and 3.0.x before 3.0.10, and SeaMonkey 2.x before 2.0.10, when JavaScript is enabled, allows remote attackers to execute arbitrary code via vectors related to nsCSSFrameConstructor::ContentAppended, the appendChild method, incorrect index tracking, and the creation of multiple frames, which triggers memory corruption, as exploited in the wild in October 2010 by the Belmoo malware.","provenance":"source","from":"NVD"},"summary":{"text":"A memory corruption flaw in Mozilla Firefox 3.5.x through 3.5.14 and 3.6.x through 3.6.11, Thunderbird 3.0.x before 3.0.10 and 3.1.6 before 3.1.6, and SeaMonkey 2.x before 2.0.10 lies in the nsCSSFrameConstructor::ContentAppended routine, triggered by appendChild calls with incorrect index tracking when multiple frames are created. An attacker can execute arbitrary code by getting a user to load a malicious page while JavaScript is enabled, requiring no network access beyond reaching the page or authentication.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:09:58Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.83156,"percentile":0.99674,"date":"2026-10-28","provenance":"source"},"kev":{"dateAdded":"2025-10-06","dueDate":"2025-10-27","ransomware":false,"requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"https://www.mozilla.org/en-US/security/advisories/mfsa2010-73 ; https://nvd.nist.gov/vuln/detail/CVE-2010-3765","provenance":"source"},"vulncheckKev":{"dateAdded":"2010-10-27","exploitedFirstSeen":"2010-10-27","ransomware":false,"evidence":[{"url":"https://www.cve.org/CVERecord?id=CVE-2010-3765","date":"2010-10-27"},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2010-73/","date":"2010-10-27"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2025-10-06"},{"url":"https://cyble.com/resources/research-reports/global-cybersecurity-report/","date":"2025-12-11"},{"url":"https://www.loginsoft.com/reports/annually/vulnerability-intelligence-report-2025","date":"2026-01-20"}],"evidenceTotal":5,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-119","name":"Improper Restriction of Operations within the Bounds of a Memory Buffer"}],"references":[{"url":"http://blog.mozilla.com/security/2010/10/26/critical-vulnerability-in-firefox-3-5-and-firefox-3-6/","tags":["Vendor Advisory"]},{"url":"http://blogs.sun.com/security/entry/multiple_vulnerabilities_in_mozilla_firefox","tags":["Broken Link"]},{"url":"http://isc.sans.edu/diary.html?storyid=9817","tags":["Press/Media Coverage"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2010-November/050233.html","tags":["Third Party Advisory"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2010-October/050061.html","tags":["Third Party Advisory"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2010-October/050077.html","tags":["Third Party Advisory"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2010-October/050154.html","tags":["Third Party Advisory"]},{"url":"http://norman.com/about_norman/press_center/news_archive/2010/129223/en?utm_source=twitterfeed&utm_medium=twitter","tags":["Product"]},{"url":"http://secunia.com/advisories/41761","tags":["Vendor Advisory"]},{"url":"http://secunia.com/advisories/41965","tags":["Vendor Advisory"]},{"url":"http://secunia.com/advisories/41966","tags":["Vendor Advisory"]},{"url":"http://secunia.com/advisories/41969","tags":["Vendor Advisory"]},{"url":"http://secunia.com/advisories/41975","tags":["Vendor Advisory"]},{"url":"http://secunia.com/advisories/42003","tags":["Vendor Advisory"]},{"url":"http://secunia.com/advisories/42008","tags":["Vendor Advisory"]},{"url":"http://secunia.com/advisories/42043","tags":["Vendor Advisory"]},{"url":"http://secunia.com/advisories/42867","tags":["Vendor Advisory"]},{"url":"http://slackware.com/security/viewer.php?l=slackware-security&y=2010&m=slackware-security.556706","tags":["Third Party Advisory"]},{"url":"http://support.avaya.com/css/P8/documents/100114329","tags":["Third Party Advisory"]},{"url":"http://support.avaya.com/css/P8/documents/100114335","tags":["Third Party Advisory"]},{"url":"http://www.debian.org/security/2010/dsa-2124","tags":["Third Party Advisory"]},{"url":"http://www.exploit-db.com/exploits/15341","tags":["Exploit"]},{"url":"http://www.exploit-db.com/exploits/15342","tags":["Exploit"]},{"url":"http://www.exploit-db.com/exploits/15352","tags":["Exploit"]},{"url":"http://www.mandriva.com/security/advisories?name=MDVSA-2010:213","tags":["Third Party Advisory"]},{"url":"http://www.mandriva.com/security/advisories?name=MDVSA-2010:219","tags":["Third Party Advisory"]},{"url":"http://www.mozilla.org/security/announce/2010/mfsa2010-73.html","tags":["Third Party Advisory"]},{"url":"http://www.norman.com/about_norman/press_center/news_archive/2010/129223/","tags":["Broken Link"]},{"url":"http://www.norman.com/security_center/virus_description_archive/129146/","tags":["Broken Link"]},{"url":"http://www.redhat.com/support/errata/RHSA-2010-0808.html","tags":["Third Party Advisory"]},{"url":"http://www.redhat.com/support/errata/RHSA-2010-0809.html","tags":["Third Party Advisory"]},{"url":"http://www.redhat.com/support/errata/RHSA-2010-0810.html","tags":["Third Party Advisory"]},{"url":"http://www.redhat.com/support/errata/RHSA-2010-0861.html","tags":["Third Party Advisory"]},{"url":"http://www.redhat.com/support/errata/RHSA-2010-0896.html","tags":["Third Party Advisory"]},{"url":"http://www.securityfocus.com/bid/44425","tags":["Broken Link"]},{"url":"http://www.securitytracker.com/id?1024645","tags":["Broken Link"]},{"url":"http://www.securitytracker.com/id?1024650","tags":["Broken Link"]},{"url":"http://www.securitytracker.com/id?1024651","tags":["Broken Link"]},{"url":"http://www.ubuntu.com/usn/USN-1011-2","tags":["Third Party Advisory"]},{"url":"http://www.ubuntu.com/usn/USN-1011-3","tags":["Third Party Advisory"]},{"url":"http://www.ubuntu.com/usn/usn-1011-1","tags":["Third Party Advisory"]},{"url":"http://www.vupen.com/english/advisories/2010/2837","tags":["Vendor Advisory"]},{"url":"http://www.vupen.com/english/advisories/2010/2857","tags":["Vendor Advisory"]},{"url":"http://www.vupen.com/english/advisories/2010/2864","tags":["Vendor Advisory"]},{"url":"http://www.vupen.com/english/advisories/2010/2871","tags":["Vendor Advisory"]},{"url":"http://www.vupen.com/english/advisories/2011/0061","tags":["Vendor Advisory"]},{"url":"https://bugzilla.mozilla.org/show_bug.cgi?id=607222","tags":["Issue Tracking"]},{"url":"https://bugzilla.mozilla.org/show_bug.cgi?id=607222#c53","tags":["Issue Tracking"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=646997","tags":["Issue Tracking"]},{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12108","tags":["Third Party Advisory"]},{"url":"https://rhn.redhat.com/errata/RHSA-2010-0812.html","tags":["Third Party Advisory"]},{"url":"http://blog.mozilla.com/security/2010/10/26/critical-vulnerability-in-firefox-3-5-and-firefox-3-6/","tags":["Vendor Advisory"]},{"url":"http://blogs.sun.com/security/entry/multiple_vulnerabilities_in_mozilla_firefox","tags":["Broken Link"]},{"url":"http://isc.sans.edu/diary.html?storyid=9817","tags":["Press/Media Coverage"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2010-November/050233.html","tags":["Third Party Advisory"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2010-October/050061.html","tags":["Third Party Advisory"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2010-October/050077.html","tags":["Third Party Advisory"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2010-October/050154.html","tags":["Third Party Advisory"]},{"url":"http://norman.com/about_norman/press_center/news_archive/2010/129223/en?utm_source=twitterfeed&utm_medium=twitter","tags":["Product"]},{"url":"http://secunia.com/advisories/41761","tags":["Vendor Advisory"]},{"url":"http://secunia.com/advisories/41965","tags":["Vendor Advisory"]},{"url":"http://secunia.com/advisories/41966","tags":["Vendor Advisory"]},{"url":"http://secunia.com/advisories/41969","tags":["Vendor Advisory"]},{"url":"http://secunia.com/advisories/41975","tags":["Vendor Advisory"]},{"url":"http://secunia.com/advisories/42003","tags":["Vendor Advisory"]},{"url":"http://secunia.com/advisories/42008","tags":["Vendor Advisory"]},{"url":"http://secunia.com/advisories/42043","tags":["Vendor Advisory"]},{"url":"http://secunia.com/advisories/42867","tags":["Vendor Advisory"]},{"url":"http://slackware.com/security/viewer.php?l=slackware-security&y=2010&m=slackware-security.556706","tags":["Third Party Advisory"]},{"url":"http://support.avaya.com/css/P8/documents/100114329","tags":["Third Party Advisory"]},{"url":"http://support.avaya.com/css/P8/documents/100114335","tags":["Third Party Advisory"]},{"url":"http://www.debian.org/security/2010/dsa-2124","tags":["Third Party Advisory"]},{"url":"http://www.exploit-db.com/exploits/15341","tags":["Exploit"]},{"url":"http://www.exploit-db.com/exploits/15342","tags":["Exploit"]},{"url":"http://www.exploit-db.com/exploits/15352","tags":["Exploit"]},{"url":"http://www.mandriva.com/security/advisories?name=MDVSA-2010:213","tags":["Third Party Advisory"]},{"url":"http://www.mandriva.com/security/advisories?name=MDVSA-2010:219","tags":["Third Party Advisory"]},{"url":"http://www.mozilla.org/security/announce/2010/mfsa2010-73.html","tags":["Third Party Advisory"]},{"url":"http://www.norman.com/about_norman/press_center/news_archive/2010/129223/","tags":["Broken Link"]},{"url":"http://www.norman.com/security_center/virus_description_archive/129146/","tags":["Broken Link"]},{"url":"http://www.redhat.com/support/errata/RHSA-2010-0808.html","tags":["Third Party Advisory"]},{"url":"http://www.redhat.com/support/errata/RHSA-2010-0809.html","tags":["Third Party Advisory"]},{"url":"http://www.redhat.com/support/errata/RHSA-2010-0810.html","tags":["Third Party Advisory"]},{"url":"http://www.redhat.com/support/errata/RHSA-2010-0861.html","tags":["Third Party Advisory"]},{"url":"http://www.redhat.com/support/errata/RHSA-2010-0896.html","tags":["Third Party Advisory"]},{"url":"http://www.securityfocus.com/bid/44425","tags":["Broken Link"]},{"url":"http://www.securitytracker.com/id?1024645","tags":["Broken Link"]},{"url":"http://www.securitytracker.com/id?1024650","tags":["Broken Link"]},{"url":"http://www.securitytracker.com/id?1024651","tags":["Broken Link"]},{"url":"http://www.ubuntu.com/usn/USN-1011-2","tags":["Third Party Advisory"]},{"url":"http://www.ubuntu.com/usn/USN-1011-3","tags":["Third Party Advisory"]},{"url":"http://www.ubuntu.com/usn/usn-1011-1","tags":["Third Party Advisory"]},{"url":"http://www.vupen.com/english/advisories/2010/2837","tags":["Vendor Advisory"]},{"url":"http://www.vupen.com/english/advisories/2010/2857","tags":["Vendor Advisory"]},{"url":"http://www.vupen.com/english/advisories/2010/2864","tags":["Vendor Advisory"]},{"url":"http://www.vupen.com/english/advisories/2010/2871","tags":["Vendor Advisory"]},{"url":"http://www.vupen.com/english/advisories/2011/0061","tags":["Vendor Advisory"]},{"url":"https://bugzilla.mozilla.org/show_bug.cgi?id=607222","tags":["Issue Tracking"]},{"url":"https://bugzilla.mozilla.org/show_bug.cgi?id=607222#c53","tags":["Issue Tracking"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=646997","tags":["Issue Tracking"]},{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12108","tags":["Third Party Advisory"]},{"url":"https://rhn.redhat.com/errata/RHSA-2010-0812.html","tags":["Third Party Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2010-3765","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"source","basis":"ctid-cve","bases":["ctid-cve"],"basisDetail":"CTID attack_to_cve (Phase 1)","mappingType":"uncategorized","evidence":[],"confidence":"low","confidenceNote":"CTID attack_to_cve Phase 1 \"Uncategorized\" mapping (not staged by impact)"},{"id":"T1548","name":"Abuse Elevation Control Mechanism","tactics":["privilege-escalation"],"provenance":"source","basis":"ctid-cve","bases":["ctid-cve"],"basisDetail":"CTID attack_to_cve (Phase 1)","mappingType":"uncategorized","evidence":[],"confidence":"low","confidenceNote":"CTID attack_to_cve Phase 1 \"Uncategorized\" mapping (not staged by impact)"},{"id":"T1189","name":"Drive-by Compromise","tactics":["initial-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Remote attacker lures victim to malicious web content","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"allows remote attackers to execute arbitrary code via vectors related to","start":180,"end":252}],"model":"claude-haiku-5-5","confidence":"low","confidenceNote":"server-side bug exploitable without user interaction; client-execution technique does not fit"},{"id":"T1059.007","name":"JavaScript","tactics":["execution"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: JavaScript execution yields arbitrary code execution","mappingType":"primary_impact","evidence":[{"from":"description","quote":"when JavaScript is enabled, allows remote attackers to execute arbitrary code","start":152,"end":229}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2010-3744","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2010-3744","exploited":true,"exploitedSince":"2025-10-06","provenance":"source"},"exploits":[{"id":15341,"url":"https://www.exploit-db.com/exploits/15341","title":"Mozilla Firefox - Interleaving 'document.write' / 'appendChild' Denial of Service","type":"dos","platform":"multiple","date":"2010-10-28","verified":true,"provenance":"source"},{"id":15342,"url":"https://www.exploit-db.com/exploits/15342","title":"Mozilla Firefox - Simplified Memory Corruption (PoC)","type":"dos","platform":"multiple","date":"2010-10-28","verified":true,"provenance":"source"},{"id":15352,"url":"https://www.exploit-db.com/exploits/15352","title":"Mozilla Firefox 3.6.8 < 3.6.11 - Interleaving 'document.write' / 'appendChild' Remote Overflow","type":"remote","platform":"windows","date":"2010-10-29","verified":true,"provenance":"source"},{"id":16509,"url":"https://www.exploit-db.com/exploits/16509","title":"Mozilla Firefox - Interleaving 'document.write' / 'appendChild' (Metasploit)","type":"remote","platform":"windows","date":"2011-02-22","verified":true,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":4,"earliest":"2010-10-28"},"metasploit":[{"name":"Mozilla Firefox Interleaved document.write/appendChild Memory Corruption","module":"exploit/windows/browser/mozilla_interleaved_write","type":"exploit","disclosureDate":"2010-10-25","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/mozilla_interleaved_write.rb"}],"first":{"date":"2010-10-25","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/mozilla_interleaved_write.rb"},"provenance":"source"},"exploitRefs":["http://www.exploit-db.com/exploits/15341","http://www.exploit-db.com/exploits/15342","http://www.exploit-db.com/exploits/15352"],"flow":[{"stage":"primary","techniques":["T1059.007"],"provenance":"ai"},{"stage":"related","techniques":["T1189","T1190","T1548"],"provenance":"ai","lowConfidence":true}],"timeline":[{"date":"2010-10-25","kind":"exploit-public","label":"First public exploit: Metasploit; later: Exploit-DB 2010-10-28","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/mozilla_interleaved_write.rb","provenance":"source"},{"date":"2010-10-27","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.cve.org/CVERecord?id=CVE-2010-3765","provenance":"source"},{"date":"2010-10-28","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2010-3765","provenance":"source"},{"date":"2025-10-06","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2025-10-06","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2010-3744","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"Metasploit","daysToKev":5457},"priority":{"score":69.8,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 5846 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.93,"detail":"percentile 0.9967"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"3 NVD references tagged Exploit; 4 Exploit-DB entries; 1 Metasploit module"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}