CVE-2009-1312: Mozilla Firefox before 3.0.9 and SeaMonkey 1.1.17 do not block javascript: URIs in Refresh headers in HTTP...

Security readout for executives and security teams

CVE-2009-1312 is an old browser XSS issue where Mozilla browsers mishandled javascript: values in HTTP Refresh headers. A malicious or compromised site could cause script execution in affected Firefox, SeaMonkey, or older Mozilla builds. Business urgency is mainly legacy exposure: modern environments should be unaffected unless obsolete browsers remain in use. Exposure is likely limited to unmanaged or legacy endpoints still using affected Mozilla browser versions. Server exposure depends on whether applications or intermediaries can inject or control Refresh headers viewed by those browsers. Treat this as a legacy hygiene issue unless obsolete Mozilla browsers are still deployed. Prioritize removal or upgrade during endpoint compliance work, not as an emergency response item, because the bundle does not show active exploitation. Mitigation focus: Upgrade Firefox to 3.0.9 or later where legacy Firefox remains present.; Upgrade SeaMonkey to 1.1.17 or later where legacy SeaMonkey remains present.; Remove unsupported Mozilla 1.7.x-era browsers from managed endpoints..

Prepared

Jun 28, 2026, 11:04 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.