CVE-2007-5947: The jar protocol handler in Mozilla Firefox before 2.0.0.10 and SeaMonkey before 1.1.7 retrieves the inner...

Security readout for executives and security teams

Older Mozilla-family browsers mishandled jar: links. A crafted web link could make HTML inside an archive be treated as if it belonged to another site, enabling cross-site scripting. Modern exposure is mainly legacy desktops or bundled old browser engines; the bundle does not provide evidence of current exploitation. Exposure is likely limited to environments still running Firefox before 2.0.0.10, SeaMonkey before 1.1.7, or old Linux distribution packages carrying those browser builds. The provided affected-product metadata is incomplete. Low for most modern organizations, but handle promptly if legacy browsers remain in production, kiosks, lab systems, or archived virtual desktops that access internal web apps. Mitigation focus: Remove or isolate obsolete Mozilla-family browsers from managed endpoints.; Upgrade Firefox to 2.0.0.10 or later where legacy Firefox is still required.; Upgrade SeaMonkey to 1.1.7 or later where legacy SeaMonkey is still required..

Prepared

Jun 28, 2026, 19:45 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.