Every CVE Search/ Get API key

CVE-2013-1670

The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 21.0, Firefox ESR 17.x...

4.3 MediumPublic exploit

The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 21.0, Firefox ESR 17.x before 17.0.6, Thunderbird before 17.0.6, and Thunderbird ESR 17.x before 17.0.6 does not prevent acquisition of chrome privileges during calls to content level constructors, which allows remote attackers to bypass certain read-only restrictions and conduct cross-site scripting (XSS) attacks via a crafted web site.

Exploit likelihood

12.0%Down 25.5 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 4.3

The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 21.0, Firefox ESR 17.x before 17.0.6, Thunderbird before 17.0.6, and Thunderbird ESR 17.x before 17.0.6 does not prevent acquisition of chrome privileges during calls to content level constructors, which allows remote attackers to bypass certain read-only restrictions and conduct cross-site scripting (XSS) attacks via a crafted web site.

Record
CVE-2013-1670
CVSS 2.0
4.3 MediumAV:N/AC:M/Au:N/C:N/I:P/A:N
Weakness
CWE-79, CWE-264
Updated
2026-11-02
CVE List No score

The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 21.0, Firefox ESR 17.x before 17.0.6, Thunderbird before 17.0.6, and Thunderbird ESR 17.x before 17.0.6 does not prevent acquisition of chrome privileges during calls to content level constructors, which allows remote attackers to bypass certain read-only restrictions and conduct cross-site scripting (XSS) attacks via a crafted web site.

Record
CVE-2013-1670
Updated
2026-11-02
EUVDEUVD-2013-1697 No score

The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 21.0, Firefox ESR 17.x before 17.0.6, Thunderbird before 17.0.6, and Thunderbird ESR 17.x before 17.0.6 does not prevent acquisition of chrome privileges during calls to content level constructors, which allows remote attackers to bypass certain read-only restrictions and conduct cross-site scripting (XSS) attacks via a crafted web site.

Record
EUVD-2013-1697
Updated
2026-11-03
GitHub AdvisoriesGHSA-wmq6-5fp5-6pfg No score

The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 21.0, Firefox ESR 17.x...

The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 21.0, Firefox ESR 17.x before 17.0.6, Thunderbird before 17.0.6, and Thunderbird ESR 17.x before 17.0.6 does not prevent acquisition of chrome privileges during calls to content level constructors, which allows remote attackers to bypass certain read-only restrictions and conduct cross-site scripting (XSS) attacks via a crafted web site.

Record
GHSA-wmq6-5fp5-6pfg
Weakness
CWE-79
Updated
2026-11-02
OSVopenSUSE-SU-2024:10071-1 No score

MozillaFirefox-50.1.0-1.1 on GA media

These are all security issues fixed in the MozillaFirefox-50.1.0-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10071-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:10230-1 No score

MozillaThunderbird-45.5.1-1.1 on GA media

These are all security issues fixed in the MozillaThunderbird-45.5.1-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10230-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:14572-1 No score

firefox-esr-128.5.1-1.1 on GA media

These are all security issues fixed in the firefox-esr-128.5.1-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:14572-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
iceweasel
Debian:7
From an advisory covering 22 CVEs
 before 17.0.6esr-1~deb7u1, plus listed versions
10.0.12esr-110.0.12esr-1+alpha10.0.12esr-1+nmu110.0.12esr-1+nmu1+alpha11.0-1
Show 31 moreShow less
11.0-211.0-311.0-411.0~b1-111.0~b1-211.0~b2-111.0~b3-111.0~b4-111.0~b5-111.0~b6-112.0-112.0-212.0-312.0-412.0-512.0-612.0-713.0-113.0.1-113.0.1-214.0.1-114.0.1-215.0-115.0.1-116.0-116.0.1-116.0.2-117.0-117.0.1-117.0.1-217.0.5esr-1
17.0.6esr-1~deb7u1
icedove
Debian:7
From an advisory covering 21 CVEs
 before 17.0.7-1~deb7u1, plus listed versions
10.0.12-111.0-116.0.2-117.0-117.0.2-117.0.4-117.0.5-117.0.5-2
17.0.7-1~deb7u1
firefox
Red Hat:enterprise_linux:5::server
From an advisory covering 10 CVEs
 before 0:17.0.6-1.el5_9
0:17.0.6-1.el5_9
firefox-debuginfo
Red Hat:enterprise_linux:5::server
From an advisory covering 10 CVEs
 before 0:17.0.6-1.el5_9
0:17.0.6-1.el5_9
xulrunner
Red Hat:enterprise_linux:5::server
From an advisory covering 10 CVEs
 before 0:17.0.6-1.el5_9
0:17.0.6-1.el5_9
xulrunner-debuginfo
Red Hat:enterprise_linux:5::server
From an advisory covering 10 CVEs
 before 0:17.0.6-1.el5_9
0:17.0.6-1.el5_9
xulrunner-devel
Red Hat:enterprise_linux:5::server
From an advisory covering 10 CVEs
 before 0:17.0.6-1.el5_9
0:17.0.6-1.el5_9
firefox
Red Hat:enterprise_linux:6::client
From an advisory covering 10 CVEs
 before 0:17.0.6-1.el6_4
0:17.0.6-1.el6_4
firefox-debuginfo
Red Hat:enterprise_linux:6::client
From an advisory covering 10 CVEs
 before 0:17.0.6-1.el6_4
0:17.0.6-1.el6_4
xulrunner
Red Hat:enterprise_linux:6::client
From an advisory covering 10 CVEs
 before 0:17.0.6-2.el6_4
0:17.0.6-2.el6_4
Show 28 moreShow less
Affected packages
PackageAffectedFixed
xulrunner-debuginfo
Red Hat:enterprise_linux:6::client
From an advisory covering 10 CVEs
 before 0:17.0.6-2.el6_4
0:17.0.6-2.el6_4
xulrunner-devel
Red Hat:enterprise_linux:6::client
From an advisory covering 10 CVEs
 before 0:17.0.6-2.el6_4
0:17.0.6-2.el6_4
firefox
Red Hat:enterprise_linux:6::computenode
From an advisory covering 10 CVEs
 before 0:17.0.6-1.el6_4
0:17.0.6-1.el6_4
firefox-debuginfo
Red Hat:enterprise_linux:6::computenode
From an advisory covering 10 CVEs
 before 0:17.0.6-1.el6_4
0:17.0.6-1.el6_4
xulrunner
Red Hat:enterprise_linux:6::computenode
From an advisory covering 10 CVEs
 before 0:17.0.6-2.el6_4
0:17.0.6-2.el6_4
xulrunner-debuginfo
Red Hat:enterprise_linux:6::computenode
From an advisory covering 10 CVEs
 before 0:17.0.6-2.el6_4
0:17.0.6-2.el6_4
xulrunner-devel
Red Hat:enterprise_linux:6::computenode
From an advisory covering 10 CVEs
 before 0:17.0.6-2.el6_4
0:17.0.6-2.el6_4
firefox
Red Hat:enterprise_linux:6::server
From an advisory covering 10 CVEs
 before 0:17.0.6-1.el6_4
0:17.0.6-1.el6_4
firefox-debuginfo
Red Hat:enterprise_linux:6::server
From an advisory covering 10 CVEs
 before 0:17.0.6-1.el6_4
0:17.0.6-1.el6_4
xulrunner
Red Hat:enterprise_linux:6::server
From an advisory covering 10 CVEs
 before 0:17.0.6-2.el6_4
0:17.0.6-2.el6_4
xulrunner-debuginfo
Red Hat:enterprise_linux:6::server
From an advisory covering 10 CVEs
 before 0:17.0.6-2.el6_4
0:17.0.6-2.el6_4
xulrunner-devel
Red Hat:enterprise_linux:6::server
From an advisory covering 10 CVEs
 before 0:17.0.6-2.el6_4
0:17.0.6-2.el6_4
firefox
Red Hat:enterprise_linux:6::workstation
From an advisory covering 10 CVEs
 before 0:17.0.6-1.el6_4
0:17.0.6-1.el6_4
firefox-debuginfo
Red Hat:enterprise_linux:6::workstation
From an advisory covering 10 CVEs
 before 0:17.0.6-1.el6_4
0:17.0.6-1.el6_4
xulrunner
Red Hat:enterprise_linux:6::workstation
From an advisory covering 10 CVEs
 before 0:17.0.6-2.el6_4
0:17.0.6-2.el6_4
xulrunner-debuginfo
Red Hat:enterprise_linux:6::workstation
From an advisory covering 10 CVEs
 before 0:17.0.6-2.el6_4
0:17.0.6-2.el6_4
xulrunner-devel
Red Hat:enterprise_linux:6::workstation
From an advisory covering 10 CVEs
 before 0:17.0.6-2.el6_4
0:17.0.6-2.el6_4
thunderbird
Red Hat:rhel_productivity:5
From an advisory covering 10 CVEs
 before 0:17.0.6-1.el5_9
0:17.0.6-1.el5_9
thunderbird-debuginfo
Red Hat:rhel_productivity:5
From an advisory covering 10 CVEs
 before 0:17.0.6-1.el5_9
0:17.0.6-1.el5_9
thunderbird
Red Hat:enterprise_linux:6::client
From an advisory covering 10 CVEs
 before 0:17.0.6-2.el6_4
0:17.0.6-2.el6_4
thunderbird-debuginfo
Red Hat:enterprise_linux:6::client
From an advisory covering 10 CVEs
 before 0:17.0.6-2.el6_4
0:17.0.6-2.el6_4
thunderbird
Red Hat:enterprise_linux:6::server
From an advisory covering 10 CVEs
 before 0:17.0.6-2.el6_4
0:17.0.6-2.el6_4
thunderbird-debuginfo
Red Hat:enterprise_linux:6::server
From an advisory covering 10 CVEs
 before 0:17.0.6-2.el6_4
0:17.0.6-2.el6_4
thunderbird
Red Hat:enterprise_linux:6::workstation
From an advisory covering 10 CVEs
 before 0:17.0.6-2.el6_4
0:17.0.6-2.el6_4
thunderbird-debuginfo
Red Hat:enterprise_linux:6::workstation
From an advisory covering 10 CVEs
 before 0:17.0.6-2.el6_4
0:17.0.6-2.el6_4
MozillaFirefox
openSUSE:Tumbleweed
From an advisory covering 899 CVEs
 before 50.1.0-1.1
50.1.0-1.1
MozillaThunderbird
openSUSE:Tumbleweed
From an advisory covering 560 CVEs
 before 45.5.1-1.1
45.5.1-1.1
firefox-esr
openSUSE:Tumbleweed
From an advisory covering 1860 CVEs
 before 128.5.1-1.1
128.5.1-1.1

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
Exploit-DBMozilla Firefox - toString console.time Privileged JavaScript Injection (Metasploit)2014-08-19

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, Exploit-DB, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2013-1670 is a medium vulnerability (CVSS 4.3) in Mozilla Firefox, published May 16, 2013. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 12.0%, the 96th percentile. No source names a fixed version.

References

Show 194 moreShow less
This page doesn't list everything

Left out here: 1,944 references. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open