CVE-2013-0748: The XBL.__proto__.toString implementation in Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 a...

Security readout for executives and security teams

This issue affected older Mozilla browsers and mail clients. A remote attacker could use an XBL object behavior to make ASLR, a memory-exploitation defense, easier to bypass. The sources do not describe this as standalone compromise, but it could reduce protection against other memory-safety bugs. Exposure is most plausible on legacy systems running Firefox before 18.0, Firefox ESR 10.x before 10.0.12 or 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderbird ESR before fixed ESR releases, or SeaMonkey before 2.15. Prioritize remediation where legacy Mozilla clients remain in production, especially on systems exposed to untrusted web or email content. This is old and not KEV-listed, but it weakens a core exploit mitigation. Mitigation focus: Upgrade Mozilla products to the fixed versions named in the advisory data.; Apply relevant SUSE, Red Hat, Ubuntu, or openSUSE security updates.; Remove unsupported Firefox, Thunderbird, and SeaMonkey builds from managed endpoints..

Prepared

Jun 24, 2026, 12:04 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.