CVE-2009-4101: infoRSS 1.1.4.2 and earlier extension for Firefox performs certain operations with chrome privileges, which...

Security readout for executives and security teams

CVE-2009-4101 affects the legacy infoRSS Firefox extension version 1.1.4.2 and earlier. A malicious RSS feed could abuse the extension’s elevated browser privileges to run arbitrary commands or perform cross-domain scripting. Business urgency is mainly for legacy desktop environments, old browser images, or managed profiles still using this add-on. Exposure is likely limited to systems running Firefox with infoRSS 1.1.4.2 or earlier installed. Risk increases where users subscribe to untrusted RSS feeds or legacy browser profiles remain unmanaged. Modern environments without this extension are not exposed based on the provided sources. Prioritize as a legacy exposure cleanup item unless your organization still uses infoRSS. If present, treat as high priority because the described impact includes arbitrary command execution from remote RSS content. If absent, no direct action is indicated beyond confirming inventory. Mitigation focus: Inventory Firefox add-ons for infoRSS, especially version 1.1.4.2 or earlier.; Remove infoRSS where it is no longer business-required.; If required, check Mozilla add-on history and vendor guidance for safer versions..

Prepared

Jun 28, 2026, 13:14 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.