CVE-2009-1308: Cross-site scripting (XSS) vulnerability in Mozilla Firefox before 3.0.9, Thunderbird, and SeaMonkey allows...

Security readout for executives and security teams

This is an old Mozilla browser-family XSS flaw. A malicious page could cause vulnerable Firefox, Thunderbird, or SeaMonkey versions to run injected web script or HTML. The bundle states it was exploited in a March 2009 eBay listing, but KEV does not list it as currently known exploited. Most exposure should be limited to obsolete Mozilla Firefox before 3.0.9, and legacy Thunderbird or SeaMonkey installations. Current enterprise exposure depends on whether old desktop images, unsupported kiosks, lab systems, or archived virtual machines still include these clients. Treat this as a cleanup and legacy exposure issue unless unsupported Mozilla clients are still in use. Historical exploitation raises concern, but the age of the products makes asset discovery more important than emergency response. Mitigation focus: Upgrade Firefox to 3.0.9 or later where legacy Firefox remains present.; Check vendor advisories for fixed Thunderbird and SeaMonkey versions.; Remove unsupported Mozilla clients from managed endpoints and images..

Prepared

Jun 28, 2026, 11:04 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.