{"id":"CVE-2007-1084","aliases":["DEBIAN-CVE-2007-1084","EUVD-2007-1081","GHSA-3799-mwjc-pmj8"],"status":"published","title":"Mozilla Firefox 2.0.0.1 and earlier does not prompt users before saving bookmarklets, which...","description":"Mozilla Firefox 2.0.0.1 and earlier does not prompt users before saving bookmarklets, which allows remote attackers to bypass the same-domain policy by tricking a user into saving a bookmarklet with a data: scheme, which is executed in the context of the last visited web page.","severity":{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.01514,"percentile":0.7465,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-16"],"published":"2007-02-23T00:00:00Z","modified":"2026-10-21T17:47:40Z","affected":[{"source":"osv","ecosystem":"Debian:12","package":"epiphany-browser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["43.1-1","44.0-1","44.1-1","44.2-1","44.3-1","44.5-1","44.5-2","44.6-1","44~rc-1","45.0-1","45.1-1","45.2-1","45~beta-1","46.0-1","46.0-2","46.1-1","46.2-1","46.3-1","46~alpha-1","46~beta-1","47.0-1","47.2-1","47~beta-1","47~rc-1","48.0-1","48.1-1","48.2-1","48.3-1","48.3-2","48.5-1","48.5-2","48.5-3","48~beta-1","48~rc-1","48~rc-2","49.0-1","49.1-1","49.2-1","49.2-2","49.2-3","50.3-1","50.3-2","50.4-1","50.4-2","51.0-1","51.1-1","51~rc-1"]},{"source":"osv","ecosystem":"Debian:13","package":"epiphany-browser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["48.3-2","48.5-0+deb13u1","48.5-1","48.5-2","48.5-3","49.0-1","49.1-1","49.2-1","49.2-2","49.2-3","50.3-1","50.3-2","50.4-1","50.4-2","51.0-1","51.1-1","51~rc-1"]},{"source":"osv","ecosystem":"Debian:14","package":"epiphany-browser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["48.3-2","48.5-1","48.5-2","48.5-3","49.0-1","49.1-1","49.2-1","49.2-2","49.2-3","50.3-1","50.3-2","50.4-1","50.4-2","51.0-1","51.1-1","51~rc-1"]}],"products":[{"vendor":"mozilla","product":"firefox"}],"references":[{"url":"http://www.securityfocus.com/archive/1/461021/100/0/threaded","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred","web"]},{"url":"http://www.securityfocus.com/archive/1/460896/100/0/threaded","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred","web"]},{"url":"http://osvdb.org/33803","tags":["vdb-entry","x_refsource_OSVDB","x_transferred","web"]},{"url":"http://lcamtuf.coredump.cx/ffbook","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"http://www.securityfocus.com/archive/1/460890/100/0/threaded","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred","web"]},{"url":"http://securityreason.com/securityalert/2304","tags":["third-party-advisory","x_refsource_SREASON","x_transferred","web"]},{"url":"http://www.securityfocus.com/archive/1/460885/100/0/threaded","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred","web"]},{"url":"http://lcamtuf.coredump.cx/ffbook/","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"http://www.heise-security.co.uk/news/85728","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"https://bugzilla.mozilla.org/show_bug.cgi?id=371179","tags":["x_refsource_CONFIRM","x_transferred","report"]},{"url":"http://www.securityfocus.com/bid/22666","tags":["vdb-entry","x_refsource_BID","x_transferred","web"]},{"url":"http://archives.neohapsis.com/archives/fulldisclosure/2007-02/0490.html","tags":["mailing-list","x_refsource_FULLDISC","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2007-1084"},{"url":"https://github.com/advisories/GHSA-3799-mwjc-pmj8"},{"url":"https://security-tracker.debian.org/tracker/CVE-2007-1084","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2007-1084","description":"Mozilla Firefox 2.0.0.1 and earlier does not prompt users before saving bookmarklets, which allows remote attackers to bypass the same-domain policy by tricking a user into saving a bookmarklet with a data: scheme, which is executed in the context of the last visited web page.","status":"published","published":"2007-02-23T00:00:00Z","modified":"2024-08-07T12:43:22.48Z","updated_at":"2026-11-02T13:33:52.669326Z"}],"euvd":[{"id":"EUVD-2007-1081","description":"Mozilla Firefox 2.0.0.1 and earlier does not prompt users before saving bookmarklets, which allows remote attackers to bypass the same-domain policy by tricking a user into saving a bookmarklet with a data: scheme, which is executed in the context of the last visited web page.","status":"published","published":"2007-02-23T00:00:00Z","modified":"2024-08-07T12:43:22Z","updated_at":"2026-11-03T01:38:27.157087Z"}],"ghsa":[{"id":"GHSA-3799-mwjc-pmj8","title":"Mozilla Firefox 2.0.0.1 and earlier does not prompt users before saving bookmarklets, which...","description":"Mozilla Firefox 2.0.0.1 and earlier does not prompt users before saving bookmarklets, which allows remote attackers to bypass the same-domain policy by tricking a user into saving a bookmarklet with a data: scheme, which is executed in the context of the last visited web page.","status":"published","published":"2022-05-01T17:50:20Z","modified":"2023-01-31T05:03:42Z","updated_at":"2026-11-02T14:48:31.353557Z"}],"nvd":[{"id":"CVE-2007-1084","description":"Mozilla Firefox 2.0.0.1 and earlier does not prompt users before saving bookmarklets, which allows remote attackers to bypass the same-domain policy by tricking a user into saving a bookmarklet with a data: scheme, which is executed in the context of the last visited web page.","status":"published","published":"2007-02-23T02:28:00Z","modified":"2026-06-16T22:36:54.867Z","cvss":[{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-16"],"updated_at":"2026-11-02T14:01:13.10493Z"}],"osv":[{"id":"CVE-2007-1084","description":"Mozilla Firefox 2.0.0.1 and earlier does not prompt users before saving bookmarklets, which allows remote attackers to bypass the same-domain policy by tricking a user into saving a bookmarklet with a data: scheme, which is executed in the context of the last visited web page.","status":"published","published":"2007-02-23T02:28:00Z","modified":"2026-04-10T03:38:41.994143Z","updated_at":"2026-11-02T15:43:56.865964Z"},{"id":"DEBIAN-CVE-2007-1084","description":"Mozilla Firefox 2.0.0.1 and earlier does not prompt users before saving bookmarklets, which allows remote attackers to bypass the same-domain policy by tricking a user into saving a bookmarklet with a data: scheme, which is executed in the context of the last visited web page.","status":"published","published":"2007-02-23T02:28:00Z","modified":"2026-10-21T17:47:40.318862357Z","updated_at":"2026-11-02T15:45:23.105674Z"}]}}