CVE-2009-0355: components/sessionstore/src/nsSessionStore.js in Mozilla Firefox before 3.0.6 does not block changes of INP...

Security readout for executives and security teams

This is an old Firefox flaw where a crafted page could abuse session restoration to make a file-upload field point at a local file. With user involvement, an attacker could read files from the client machine. The supplied sources identify Firefox before 3.0.6 as affected. Exposure is most likely limited to legacy systems, embedded browsers, kiosk images, or old Linux distributions still carrying Firefox versions before 3.0.6. Modern supported browsers should not be assumed affected from these sources. Treat this as a legacy exposure cleanup item unless old Firefox builds remain in production. If present, prioritize remediation because arbitrary client file read can create sensitive data leakage risk. Mitigation focus: Upgrade Firefox to 3.0.6 or later where applicable.; Apply relevant Linux vendor browser security updates.; Retire unsupported systems running Firefox before 3.0.6..

Prepared

Jun 28, 2026, 11:23 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.