CVE-2004-0867: Mozilla Firefox 0.9.2 allows web sites to set cookies for country-specific top-level domains, such as .ltd....

Security readout for executives and security teams

This is an old Firefox cookie handling flaw. A malicious website could set cookies for certain UK country-specific top-level domains, creating a path to session fixation and possible HTTP session hijacking. The practical business risk today is mainly legacy browser exposure, not modern Firefox installations. Exposure is most likely in obsolete desktop images, embedded kiosk builds, archived lab systems, or unmanaged hosts running Firefox 0.9.2 or reportedly Firefox 2.x. Organizations using current supported browsers are unlikely to be exposed based on the provided evidence. Treat this as a legacy hygiene issue unless old Firefox versions still exist. Prioritize removal where those browsers can reach authenticated business applications, because the impact described is session compromise rather than simple browsing instability. Mitigation focus: Inventory endpoints for Firefox 0.9.2 and Firefox 2.x.; Retire unsupported Firefox versions from managed and unmanaged systems.; Check Mozilla guidance before relying on any version-specific fix..

Prepared

Jun 30, 2026, 02:43 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.