CVE-2007-1116
The CheckLoadURI function in Mozilla Firefox 1.8 lists the about: URI as a ChromeProtocol and can...
The CheckLoadURI function in Mozilla Firefox 1.8 lists the about: URI as a ChromeProtocol and can be loaded via JavaScript, which allows remote attackers to obtain sensitive information by querying the browser's session history.
Exploit likelihood
What each source reports
NVD Score used
The CheckLoadURI function in Mozilla Firefox 1.8 lists the about: URI as a ChromeProtocol and can be loaded via JavaScript, which allows remote attackers to obtain sensitive information by querying the browser's session history.
- Record
CVE-2007-1116- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
CVE List No score
The CheckLoadURI function in Mozilla Firefox 1.8 lists the about: URI as a ChromeProtocol and can be loaded via JavaScript, which allows remote attackers to obtain sensitive information by querying the browser's session history.
- Record
CVE-2007-1116- Updated
- 2026-11-02
EUVDEUVD-2007-1113 No score
The CheckLoadURI function in Mozilla Firefox 1.8 lists the about: URI as a ChromeProtocol and can be loaded via JavaScript, which allows remote attackers to obtain sensitive information by querying the browser's session history.
- Record
EUVD-2007-1113- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-w3jv-r8w6-4m8j No score
The CheckLoadURI function in Mozilla Firefox 1.8 lists the about: URI as a ChromeProtocol and can...
The CheckLoadURI function in Mozilla Firefox 1.8 lists the about: URI as a ChromeProtocol and can be loaded via JavaScript, which allows remote attackers to obtain sensitive information by querying the browser's session history.
- Record
GHSA-w3jv-r8w6-4m8j- Weakness
- CWE-200
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
iceapeDebian:4.0 |
before 1.0.9-0etch1, plus listed versions 1.0.8-4 |
1.0.9-0etch1 |
xulrunnerDebian:4.0 |
before 1.8.0.12-0etch1, plus listed versions 1.8.0.11-21.8.0.11-31.8.0.11-41.8.0.11-4.1 |
1.8.0.12-0etch1 |
iceweaselDebian:4.0 |
before 2.0.0.4-0etch1, plus listed versions 2.0.0.3-12.0.0.3-2 |
2.0.0.4-0etch1 |
iceweaselDebian:5.0 |
before 2.0.0.5-0etch1+lenny1 | 2.0.0.5-0etch1+lenny1 |
iceapeDebian:5.0 |
before 1.0.10~pre070720-0etch1+lenny1 | 1.0.10~pre070720-0etch1+lenny1 |
xulrunnerDebian:5.0 |
before 1.8.0.13~pre070720-0etch3+lenny1 | 1.8.0.13~pre070720-0etch3+lenny1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| aliases | ||
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2007-1116 is a medium vulnerability (CVSS 5.0) in Mozilla Firefox, published February 26, 2007. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.16%, the 67th percentile. Fixed in iceape 1.0.9-0etch1.
References
securityfocus.com/archive/1/461006/100/0/threaded
osvdb.org/33804
bugzilla.mozilla.org/show_bug.cgi?id=371375
gnucitizen.org/projects/hscan-redux
securityreason.com/securityalert/2309
nvd.nist.gov/vuln/detail/CVE-2007-1116
github.com/advisories/GHSA-w3jv-r8w6-4m8j