CVE-2007-6589: The jar protocol handler in Mozilla Firefox before 2.0.0.10 and SeaMonkey before 1.1.7 does not update the...

Security readout for executives and security teams

This is an old browser same-origin bug. A malicious page could use a jar: URI and a redirect to make Firefox or SeaMonkey treat content from one domain as another, enabling cross-site scripting. It mainly matters where obsolete Firefox before 2.0.0.10 or SeaMonkey before 1.1.7 still exist. Exposure is likely limited to legacy endpoints running Mozilla Firefox before 2.0.0.10 or SeaMonkey before 1.1.7, including vendor-packaged browser builds referenced by HP. Modern supported browsers are not identified as affected in the supplied sources. Prioritize as a legacy hygiene issue unless affected browsers remain in production. There is no supplied evidence of active exploitation, but any remaining vulnerable browser can expose users and internal web applications to cross-site scripting risk. Mitigation focus: Upgrade Firefox to 2.0.0.10 or later where applicable.; Upgrade SeaMonkey to 1.1.7 or later where applicable.; Retire unsupported legacy browser versions from managed endpoints..

Prepared

Jun 28, 2026, 19:45 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.