You are currently viewing a snapshot of taken on April 21, 2008. Most of this content is highly out of date (some pages haven't been updated since the project began in 1998) and exists for historical purposes only. If there are any pages on this archive site that you think should be added back to, please file a bug.

You are here: Known Vulnerabilities in Mozilla Products (Firefox > MFSA 2006-72

Mozilla Foundation Security Advisory 2006-72

Title: XSS by setting img.src to javascript: URI
Impact: High
Announced: December 19, 2006
Reporter: moz_bug_r_a4
Products: Firefox, Thunderbird, SeaMonkey

Fixed in: Firefox
  SeaMonkey 1.0.7


moz_bug_r_a4 reported that the src attribute of an IMG element loaded in a frame could be changed to a javascript: URI that was able to bypass the protections against cross-site script (XSS) injection. The injected script could steal credentials and financial data, or perform destructive actions on behalf of a logged-in user.


Disable JavaScript until you can upgrade to a fixed version.


Exploit details withheld until after the active update period.