CVE-2013-1670
EXPLOITEDFirefox < 21.0 and Firefox ESR < 17.0.6 - Cross-Site Scripting via Chrome Object Wrapper
Title source: llmExploitation Summary
CVE-2013-1670 has been observed exploited in the wild (reported by VulnCheck KEV). EIP tracks 1 public exploit from researchers including Metasploit.
AI-analyzed exploit summary This Metasploit module exploits CVE-2013-1670 and CVE-2013-1710 to achieve remote code execution on Firefox 15-22 by injecting privileged JavaScript into a chrome:// context via toString and console.time manipulation.
Description
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 21.0, Firefox ESR 17.x before 17.0.6, Thunderbird before 17.0.6, and Thunderbird ESR 17.x before 17.0.6 does not prevent acquisition of chrome privileges during calls to content level constructors, which allows remote attackers to bypass certain read-only restrictions and conduct cross-site scripting (XSS) attacks via a crafted web site.
Exploits (1)
This Metasploit module exploits CVE-2013-1670 and CVE-2013-1710 to achieve remote code execution on Firefox 15-22 by injecting privileged JavaScript into a chrome:// context via toString and console.time manipulation.