CVE-2010-3765: Mozilla Multiple Products Remote Code Execution Vulnerability

Q: How do I fix CVE-2010-3765?

firefox: downgrade or apply the listed mitigation; thunderbird: downgrade or apply the listed mitigation; seamonkey: downgrade or apply the listed mitigation. Exact commands for each OS are on this page.

Q: Is CVE-2010-3765 being exploited?

Yes. CVE-2010-3765 is on the CISA Known Exploited Vulnerabilities list, so treat it as patch-now.

Q: What does CVE-2010-3765 affect?

CVE-2010-3765 affects firefox, thunderbird, seamonkey. Severity is critical (CVSS 9.8). Mozilla Firefox 3.5.x through 3.5.14 and 3.6.x through 3.6.11, Thunderbird 3.1.6 before 3.1.6 and 3.0.x before 3.0.10, and SeaMonkey 2.x before 2.0.10, when JavaScript is enabled, allows remote attackers to execute arbitrary code via vector

Q: How urgent is CVE-2010-3765?

Priority 97/100. Critical severity; EPSS top 1%: very likely to be exploited; Exploited in the wild (CISA KEV); Public exploit reference; CISA SSVC: automatable with total technical impact; Remotely exploitable, no login, no user action

Patch now

CRITICAL 9.8EXPLOITEDREMOTEDOWNGRADEDOWNGRADEDOWNGRADE

CVE-2010-3765 is a critical-severity flaw (CVSS 9.8) affecting firefox, thunderbird, seamonkey, reported as exploited in the wild. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

Mozilla Firefox 3.5.x through 3.5.14 and 3.6.x through 3.6.11, Thunderbird 3.1.6 before 3.1.6 and 3.0.x before 3.0.10, and SeaMonkey 2.x before 2.0.10, when JavaScript is enabled, allows remote attackers to execute arbitrary code via vectors related to nsCSSFrameConstructor::ContentAppended, the appendChild method, incorrect index tracking, and the creation of multiple frames, which triggers memory corruption, as exploited in the wild in October

Why this priority

Critical severity
EPSS top 1%: very likely to be exploited
Exploited in the wild (CISA KEV)
Public exploit reference
CISA SSVC: automatable with total technical impact
Remotely exploitable, no login, no user action

A fixed release or distro patch exists.

Risk facts

CVSS score	9.8 (Critical)
Attack vector	Network (remote)
Attack complexity	Low
Privileges needed	None
User interaction	None
EPSS exploit chance	83.2% (top 1%)
CISA exploited list	Yes, fix due 2025-10-27
Weakness	CWE-119
Published	2010-10-28
Last modified	2026-06-16

Publisher (CNA): MITRE · Vendor: mozilla

Last updated 2026-06-16 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2010-10-28 00:00 UTCPublished CVE record published
2025-10-06Exploited Added to the CISA Known Exploited Vulnerabilities list
2025-10-27Deadline CISA due date for US federal agencies to patch
2026-06-16 23:23 UTCUpdated Record last modified

mozilla firefox DOWNGRADE

Affected: 3.5 · 3.5.1 · 3.5.2 · 3.5.3 · 3.5.4 · 3.5.5 · 3.5.6 · 3.5.7

Fixed in: no fixed release known

Safe to downgrade to: a release before 3.5

1. Check installed version

apt-cache policy firefox || rpm -q firefox || firefox --version

2. No fixed release: DOWNGRADE to a release before 3.5 (Debian / Ubuntu)

apt-cache madison firefox sudo apt install firefox=<VERSION_BEFORE_3.5> sudo apt-mark hold firefox

2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list firefox sudo dnf downgrade firefox-<VERSION_BEFORE_3.5> sudo dnf versionlock add firefox

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

mozilla thunderbird DOWNGRADE

Affected: 3.0.1 · 3.0.2 · 3.0.3 · 3.0.4 · 3.0.5 · 3.0.6 · 3.0.7 · 3.0.8

Fixed in: no fixed release known

Safe to downgrade to: a release before 3.0.1

1. Check installed version

apt-cache policy thunderbird || rpm -q thunderbird || thunderbird --version

2. No fixed release: DOWNGRADE to a release before 3.0.1 (Debian / Ubuntu)

apt-cache madison thunderbird sudo apt install thunderbird=<VERSION_BEFORE_3.0.1> sudo apt-mark hold thunderbird

2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list thunderbird sudo dnf downgrade thunderbird-<VERSION_BEFORE_3.0.1> sudo dnf versionlock add thunderbird

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

mozilla seamonkey DOWNGRADE

Affected: 2.0 · 2.0 alpha_1 · 2.0 alpha_2 · 2.0 alpha_3 · 2.0 beta_1 · 2.0 beta_2 · 2.0 rc1 · 2.0 rc2

Fixed in: no fixed release known

Safe to downgrade to: a release before 2.0

1. Check installed version

apt-cache policy seamonkey || rpm -q seamonkey || seamonkey --version

2. No fixed release: DOWNGRADE to a release before 2.0 (Debian / Ubuntu)

apt-cache madison seamonkey sudo apt install seamonkey=<VERSION_BEFORE_2.0> sudo apt-mark hold seamonkey

2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list seamonkey sudo dnf downgrade seamonkey-<VERSION_BEFORE_2.0> sudo dnf versionlock add seamonkey

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

Exact fixes by distribution

A distro patch exists: prefer upgrading over downgrading.

Fedora 46 · dupeguru · FIXED · 4.3.1^20261101git7a2c79f-1.fc46 · FEDORA-2026-fe4523382c · source

sudo dnf upgrade --advisory=FEDORA-2026-fe4523382c

Fedora ELN · openexr · FIXED · 3.4.13-3.eln159 · FEDORA-2026-827a613db5 · source

sudo dnf upgrade --advisory=FEDORA-2026-827a613db5

RHEL 3 · seamonkey · FIXED · seamonkey-1.0.9-0.62.el3

sudo dnf upgrade --advisory=RHSA-2010:0810 rpm -q seamonkey

RHEL 4 · firefox · FIXED · firefox-3.6.11-4.el4_8

sudo dnf upgrade --advisory=RHSA-2010:0808 rpm -q firefox

RHEL 4 · seamonkey · FIXED · seamonkey-1.0.9-65.el4_8

sudo dnf upgrade --advisory=RHSA-2010:0810 rpm -q seamonkey

RHEL 4 · thunderbird · FIXED · thunderbird-1.5.0.12-33.el4

sudo dnf upgrade --advisory=RHSA-2010:0812 rpm -q thunderbird

RHEL 5 · xulrunner · FIXED · xulrunner-1.9.2.11-4.el5_5

sudo dnf upgrade --advisory=RHSA-2010:0809 rpm -q xulrunner

Public exploits and detection

Public code exists for this CVE. Treat unpatched systems as at risk, and only run PoCs in a lab.

Write-up: bugzilla.mozilla.org/show_bug.cgi?id=607222
Write-up: bugzilla.mozilla.org/show_bug.cgi?id=607222#c53
Exploit-DB: Mozilla Firefox - Interleaving 'document.write' / 'appendChild' Denial of Service
Exploit-DB: Mozilla Firefox - Simplified Memory Corruption (PoC)
Exploit-DB: Mozilla Firefox - Interleaving 'document.write' / 'appendChild' (Metasploit)
Exploit-DB: Mozilla Firefox 3.6.8 < 3.6.11 - Interleaving 'document.write' / 'appendChild' Remote Overflow
Metasploit: Mozilla Firefox Interleaved document.write/appendChild Memory Corruption

Verify at the official source NVD · CVE Program · CISA KEV catalog · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2010-3765?

firefox: downgrade or apply the listed mitigation; thunderbird: downgrade or apply the listed mitigation; seamonkey: downgrade or apply the listed mitigation. Exact commands for each OS are on this page.

Is CVE-2010-3765 being exploited?

Yes. CVE-2010-3765 is on the CISA Known Exploited Vulnerabilities list, so treat it as patch-now.

What does CVE-2010-3765 affect?

CVE-2010-3765 affects firefox, thunderbird, seamonkey. Severity is critical (CVSS 9.8). Mozilla Firefox 3.5.x through 3.5.14 and 3.6.x through 3.6.11, Thunderbird 3.1.6 before 3.1.6 and 3.0.x before 3.0.10, and SeaMonkey 2.x before 2.0.10, when JavaScript is enabled, allows remote attackers to execute arbitrary code via vector

How urgent is CVE-2010-3765?

Priority 97/100. Critical severity; EPSS top 1%: very likely to be exploited; Exploited in the wild (CISA KEV); Public exploit reference; CISA SSVC: automatable with total technical impact; Remotely exploitable, no login, no user action

Software pages

Mozilla Firefox vulnerabilities · Mozilla Thunderbird vulnerabilities

Related CVEs

CVE-2026-74990 CRITICAL 9.8 UPGRADE UPGRADE Internally found bugs present in Firefox ESR 115.38, Firefox ESR 140.13, Firefox ESR 153.0 and Firefox 153
CVE-2026-74989 CRITICAL 9.8 UPGRADE UPGRADE Internally found bugs present in Firefox 153
CVE-2026-74988 CRITICAL 9.8 UPGRADE UPGRADE Internally found bugs present in Firefox ESR 153.0 and Firefox 153
CVE-2026-74987 CRITICAL 9.8 UPGRADE UPGRADE Internally found bugs present in Firefox ESR 140.13, Firefox ESR 153.0 and Firefox 153
CVE-2026-74969 HIGH 8.8 UPGRADE UPGRADE Race condition, use-after-free in the Layout: Text and Fonts component

References

← Back to latest CVEs