CVE-2010-1585
The nsIScriptableUnescapeHTML.parseFragment method in the ParanoidFragmentSink protection...
The nsIScriptableUnescapeHTML.parseFragment method in the ParanoidFragmentSink protection mechanism in Mozilla Firefox before 3.5.17 and 3.6.x before 3.6.14, Thunderbird before 3.1.8, and SeaMonkey before 2.0.12 does not properly sanitize HTML in a chrome document, which makes it easier for remote attackers to execute arbitrary JavaScript with chrome privileges via a javascript: URI in input to an extension, as demonstrated by a javascript:alert sequence in (1) the HREF attribute of an A element or (2) the ACTION attribute of a FORM element.
Exploit likelihood
What each source reports
NVD Score used
The nsIScriptableUnescapeHTML.parseFragment method in the ParanoidFragmentSink protection mechanism in Mozilla Firefox before 3.5.17 and 3.6.x before 3.6.14, Thunderbird before 3.1.8, and SeaMonkey before 2.0.12 does not properly sanitize HTML in a chrome document, which makes it easier for remote attackers to execute arbitrary JavaScript with chrome privileges via a javascript: URI in input to an extension, as demonstrated by a javascript:alert sequence in (1) the HREF attribute of an A element or (2) the ACTION attribute of a FORM element.
- Record
CVE-2010-1585- CVSS 2.0
- 9.3 High
AV:N/AC:M/Au:N/C:C/I:C/A:C - Weakness
- CWE-20
- Updated
- 2026-11-02
CVE List No score
The nsIScriptableUnescapeHTML.parseFragment method in the ParanoidFragmentSink protection mechanism in Mozilla Firefox before 3.5.17 and 3.6.x before 3.6.14, Thunderbird before 3.1.8, and SeaMonkey before 2.0.12 does not properly sanitize HTML in a chrome document, which makes it easier for remote attackers to execute arbitrary JavaScript with chrome privileges via a javascript: URI in input to an extension, as demonstrated by a javascript:alert sequence in (1) the HREF attribute of an A element or (2) the ACTION attribute of a FORM element.
- Record
CVE-2010-1585- Updated
- 2026-11-02
EUVDEUVD-2010-1612 No score
The nsIScriptableUnescapeHTML.parseFragment method in the ParanoidFragmentSink protection mechanism in Mozilla Firefox before 3.5.17 and 3.6.x before 3.6.14, Thunderbird before 3.1.8, and SeaMonkey before 2.0.12 does not properly sanitize HTML in a chrome document, which makes it easier for remote attackers to execute arbitrary JavaScript with chrome privileges via a javascript: URI in input to an extension, as demonstrated by a javascript:alert sequence in (1) the HREF attribute of an A element or (2) the ACTION attribute of a FORM element.
- Record
EUVD-2010-1612- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-xp93-22jw-4857 No score
The nsIScriptableUnescapeHTML.parseFragment method in the ParanoidFragmentSink protection...
The nsIScriptableUnescapeHTML.parseFragment method in the ParanoidFragmentSink protection mechanism in Mozilla Firefox before 3.5.17 and 3.6.x before 3.6.14, Thunderbird before 3.1.8, and SeaMonkey before 2.0.12 does not properly sanitize HTML in a chrome document, which makes it easier for remote attackers to execute arbitrary JavaScript with chrome privileges via a javascript: URI in input to an extension, as demonstrated by a javascript:alert sequence in (1) the HREF attribute of an A element or (2) the ACTION attribute of a FORM element.
- Record
GHSA-xp93-22jw-4857- Weakness
- CWE-20
- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10218-1 No score
seamonkey-2.40-6.1 on GA media
These are all security issues fixed in the seamonkey-2.40-6.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10218-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10230-1 No score
MozillaThunderbird-45.5.1-1.1 on GA media
These are all security issues fixed in the MozillaThunderbird-45.5.1-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10230-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
iceapeDebian:6.0 |
before 2.0.11-3, plus listed versions 2.0.11-2 |
2.0.11-3 |
iceweaselDebian:6.0 |
before 3.5.16-5, plus listed versions 3.5.16-43.5.16-5~bpo50+1 |
3.5.16-5 |
icedoveDebian:6.0 |
before 3.0.11-1+squeeze1, plus listed versions 3.0.11-1 |
3.0.11-1+squeeze1 |
firefoxRed Hat:enterprise_linux:4::as |
before 0:3.6.14-4.el4 | 0:3.6.14-4.el4 |
firefox-debuginfoRed Hat:enterprise_linux:4::as |
before 0:3.6.14-4.el4 | 0:3.6.14-4.el4 |
firefoxRed Hat:enterprise_linux:4::desktop |
before 0:3.6.14-4.el4 | 0:3.6.14-4.el4 |
firefox-debuginfoRed Hat:enterprise_linux:4::desktop |
before 0:3.6.14-4.el4 | 0:3.6.14-4.el4 |
firefoxRed Hat:enterprise_linux:4::es |
before 0:3.6.14-4.el4 | 0:3.6.14-4.el4 |
firefox-debuginfoRed Hat:enterprise_linux:4::es |
before 0:3.6.14-4.el4 | 0:3.6.14-4.el4 |
firefoxRed Hat:enterprise_linux:4::ws |
before 0:3.6.14-4.el4 | 0:3.6.14-4.el4 |
Show 33 moreShow less
| Package | Affected | Fixed |
|---|---|---|
firefox-debuginfoRed Hat:enterprise_linux:4::ws |
before 0:3.6.14-4.el4 | 0:3.6.14-4.el4 |
firefoxRed Hat:enterprise_linux:5::server |
before 0:3.6.14-4.el5_6 | 0:3.6.14-4.el5_6 |
firefox-debuginfoRed Hat:enterprise_linux:5::server |
before 0:3.6.14-4.el5_6 | 0:3.6.14-4.el5_6 |
xulrunnerRed Hat:enterprise_linux:5::server |
before 0:1.9.2.14-4.el5_6 | 0:1.9.2.14-4.el5_6 |
xulrunner-debuginfoRed Hat:enterprise_linux:5::server |
before 0:1.9.2.14-4.el5_6 | 0:1.9.2.14-4.el5_6 |
xulrunner-develRed Hat:enterprise_linux:5::server |
before 0:1.9.2.14-4.el5_6 | 0:1.9.2.14-4.el5_6 |
xulrunnerRed Hat:enterprise_linux:6::client |
before 0:1.9.2.14-3.el6_0 | 0:1.9.2.14-3.el6_0 |
xulrunner-debuginfoRed Hat:enterprise_linux:6::client |
before 0:1.9.2.14-3.el6_0 | 0:1.9.2.14-3.el6_0 |
xulrunner-develRed Hat:enterprise_linux:6::client |
before 0:1.9.2.14-3.el6_0 | 0:1.9.2.14-3.el6_0 |
firefoxRed Hat:enterprise_linux:6::client |
before 0:3.6.14-4.el6_0 | 0:3.6.14-4.el6_0 |
firefox-debuginfoRed Hat:enterprise_linux:6::client |
before 0:3.6.14-4.el6_0 | 0:3.6.14-4.el6_0 |
firefoxRed Hat:enterprise_linux:6::computenode |
before 0:3.6.14-4.el6_0 | 0:3.6.14-4.el6_0 |
firefox-debuginfoRed Hat:enterprise_linux:6::computenode |
before 0:3.6.14-4.el6_0 | 0:3.6.14-4.el6_0 |
xulrunnerRed Hat:enterprise_linux:6::computenode |
before 0:1.9.2.14-3.el6_0 | 0:1.9.2.14-3.el6_0 |
xulrunner-debuginfoRed Hat:enterprise_linux:6::computenode |
before 0:1.9.2.14-3.el6_0 | 0:1.9.2.14-3.el6_0 |
xulrunner-develRed Hat:enterprise_linux:6::computenode |
before 0:1.9.2.14-3.el6_0 | 0:1.9.2.14-3.el6_0 |
xulrunnerRed Hat:enterprise_linux:6::server |
before 0:1.9.2.14-3.el6_0 | 0:1.9.2.14-3.el6_0 |
xulrunner-debuginfoRed Hat:enterprise_linux:6::server |
before 0:1.9.2.14-3.el6_0 | 0:1.9.2.14-3.el6_0 |
xulrunner-develRed Hat:enterprise_linux:6::server |
before 0:1.9.2.14-3.el6_0 | 0:1.9.2.14-3.el6_0 |
firefoxRed Hat:enterprise_linux:6::server |
before 0:3.6.14-4.el6_0 | 0:3.6.14-4.el6_0 |
firefox-debuginfoRed Hat:enterprise_linux:6::server |
before 0:3.6.14-4.el6_0 | 0:3.6.14-4.el6_0 |
xulrunnerRed Hat:enterprise_linux:6::workstation |
before 0:1.9.2.14-3.el6_0 | 0:1.9.2.14-3.el6_0 |
xulrunner-debuginfoRed Hat:enterprise_linux:6::workstation |
before 0:1.9.2.14-3.el6_0 | 0:1.9.2.14-3.el6_0 |
xulrunner-develRed Hat:enterprise_linux:6::workstation |
before 0:1.9.2.14-3.el6_0 | 0:1.9.2.14-3.el6_0 |
firefoxRed Hat:enterprise_linux:6::workstation |
before 0:3.6.14-4.el6_0 | 0:3.6.14-4.el6_0 |
firefox-debuginfoRed Hat:enterprise_linux:6::workstation |
before 0:3.6.14-4.el6_0 | 0:3.6.14-4.el6_0 |
thunderbirdRed Hat:enterprise_linux:6::client |
before 0:3.1.8-4.el6_0 | 0:3.1.8-4.el6_0 |
thunderbird-debuginfoRed Hat:enterprise_linux:6::client |
before 0:3.1.8-4.el6_0 | 0:3.1.8-4.el6_0 |
thunderbirdRed Hat:enterprise_linux:6::server |
before 0:3.1.8-4.el6_0 | 0:3.1.8-4.el6_0 |
thunderbird-debuginfoRed Hat:enterprise_linux:6::server |
before 0:3.1.8-4.el6_0 | 0:3.1.8-4.el6_0 |
thunderbirdRed Hat:enterprise_linux:6::workstation |
before 0:3.1.8-4.el6_0 | 0:3.1.8-4.el6_0 |
thunderbird-debuginfoRed Hat:enterprise_linux:6::workstation |
before 0:3.1.8-4.el6_0 | 0:3.1.8-4.el6_0 |
MozillaThunderbirdopenSUSE:Tumbleweed |
before 45.5.1-1.1 | 45.5.1-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2010-1585 is a high vulnerability (CVSS 9.3) in Mozilla Firefox, published April 28, 2010. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 4.47%, the 91st percentile. Fixed in iceape 2.0.11-3.
References
downloads.avaya.com/css/P8/documents/100133195
bugzilla.mozilla.org/show_bug.cgi?id=562547
securityfocus.com/archive/1/510883/100/0/threaded
mandriva.com/security/advisories?name=MDVSA-2011:041
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12532
security-assessment.com/files/whitepapers/Cross_Context_Scripting_with_Firefox.pdf
Show 194 moreShow less
mozilla.org/security/announce/2011/mfsa2011-08.html
wizzrss.blat.co.za/2009/11/17/so-much-for-nsiscriptableunescapehtmlparsefragment
nvd.nist.gov/vuln/detail/CVE-2010-1585
github.com/advisories/GHSA-xp93-22jw-4857
access.redhat.com/errata/RHSA-2011:0310
bugzilla.redhat.com/show_bug.cgi?id=463131
security.access.redhat.com/data/csaf/v2/advisories/2011/rhsa-2011_0310.json
cve.org/CVERecord?id=CVE-2010-1585
suse.com/security/cve/CVE-2008-5913
Left out here: 584 references. The JSON record has them.