CVE-2010-3770

Firefox < 3.5.16 and 3.6.x < 3.6.13 - Cross-Site Scripting via Character Encoding Conversion

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2010-3770. PoCs published by Yosuke Hasegawa.

AI-analyzed exploit summary This exploit demonstrates an HTML injection vulnerability in Mozilla Firefox, SeaMonkey, and Thunderbird by using a malformed meta charset tag to execute arbitrary JavaScript. The PoC leverages the 'x-mac-farsi' charset to bypass sanitization and inject script code.

Description

Multiple cross-site scripting (XSS) vulnerabilities in the rendering engine in Mozilla Firefox before 3.5.16 and 3.6.x before 3.6.13, and SeaMonkey before 2.0.11, allow remote attackers to inject arbitrary web script or HTML via (1) x-mac-arabic, (2) x-mac-farsi, or (3) x-mac-hebrew characters that may be converted to angle brackets during rendering.

Exploits (1)

exploitdb WORKING POC VERIFIED
by Yosuke Hasegawa · textremotelinux
https://www.exploit-db.com/exploits/35095

This exploit demonstrates an HTML injection vulnerability in Mozilla Firefox, SeaMonkey, and Thunderbird by using a malformed meta charset tag to execute arbitrary JavaScript. The PoC leverages the 'x-mac-farsi' charset to bypass sanitization and inject script code.

Classification
Working Poc 90%
Attack Type
Xss
Complexity
Trivial
Reliability
Reliable
Target: Mozilla Firefox < 3.6.13, Firefox < 3.5.16, SeaMonkey < 2.0.11
No auth needed
Prerequisites: Victim must visit a malicious webpage or have attacker-controlled input rendered in a vulnerable browser
MITRE ATT&CK
mistral-large-3 · analyzed Feb 16, 2026 Full analysis →

References (18)

Core 18
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/45353
Mailing List, Third Party Advisory vendor-advisory x_refsource_fedora
http://lists.fedoraproject.org/pipermail/package-announce/2010-December/052022.html
Vendor Advisory vendor-advisory x_refsource_mandriva
http://www.mandriva.com/security/advisories?name=MDVSA-2010:251
Vendor Advisory x_refsource_confirm
http://support.avaya.com/css/P8/documents/100124650
Vendor Advisory vendor-advisory x_refsource_redhat
http://www.redhat.com/support/errata/RHSA-2010-0966.html
Vendor Advisory vendor-advisory x_refsource_ubuntu
http://www.ubuntu.com/usn/USN-1019-1
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/42818
Third Party Advisory, VDB Entry vdb-entry signature x_refsource_oval
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12348
Third Party Advisory vendor-advisory x_refsource_debian
http://www.debian.org/security/2010/dsa-2132
Patch, Vendor Advisory x_refsource_confirm
http://www.mozilla.org/security/announce/2010/mfsa2010-84.html
Mailing List, Third Party Advisory vendor-advisory x_refsource_fedora
http://lists.fedoraproject.org/pipermail/package-announce/2010-December/052504.html
Third Party Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2011/0030
Mailing List, Third Party Advisory vendor-advisory x_refsource_fedora
http://lists.fedoraproject.org/pipermail/package-announce/2010-December/052502.html
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id?1024851
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/42716
Mailing List, Third Party Advisory vendor-advisory x_refsource_fedora
http://lists.fedoraproject.org/pipermail/package-announce/2010-December/052032.html

Scores

EPSS 0.0445
EPSS Percentile 90.3%

Details

CWE
CWE-79
Status published
Products (46)
mozilla/firefox 3.6
mozilla/firefox 3.6.2
mozilla/firefox 3.6.3
mozilla/firefox 3.6.4
mozilla/firefox 3.6.6
mozilla/firefox 3.6.7
mozilla/firefox 3.6.8
mozilla/firefox 3.6.9
mozilla/firefox 3.6.10
mozilla/firefox 3.6.11
... and 36 more
Published Dec 10, 2010
Tracked Since Feb 18, 2026