CVE-2009-0356: Mozilla Firefox before 3.0.6 and SeaMonkey do not block links to the (1) about:plugins and (2) about:config...

Security readout for executives and security teams

This old Mozilla browser flaw could let a malicious desktop shortcut abuse internal browser pages and run code with elevated browser privileges. It required user interaction with a crafted .desktop file, but successful exploitation could compromise the browser context and potentially the user environment on affected systems. Exposure is most likely in legacy environments still running Firefox before 3.0.6 or affected SeaMonkey builds, especially Linux desktop deployments where users may open .desktop launchers from untrusted sources. Modern, supported browser versions are unlikely to be exposed to this specific historical flaw. Treat as high priority only if legacy Mozilla browsers remain in use. For modern fleets, priority is mainly assurance: verify there are no obsolete browser packages or unmanaged Linux desktops retaining this exposure. Mitigation focus: Upgrade Firefox to 3.0.6 or later where legacy Firefox is still present.; Apply relevant Mozilla, Red Hat, SUSE, Mandriva, or platform vendor security updates.; Remove unsupported SeaMonkey or Firefox builds from managed endpoints..

Prepared

Jun 28, 2026, 11:23 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.