CVE-2010-3765
KEVCRITICAL 9.8EPSS 83.3%
Mozilla Firefox 3.5.x through 3.5.14 and 3.6.x through 3.6.11, Thunderbird 3.1.6 before 3.1.6 and 3.0.x before 3.0.10, and SeaMonkey 2.x before 2.0.10, when JavaScript is enabled, allows remote attackers to execute arbitrary code via vectors related to nsCSSFrameConstructor::ContentAppended, the appendChild method, incorrect index tracking, and the creation of multiple frames, which triggers memory corruption, as exploited in the wild in October 2010 by the Belmoo malware.
- CVSS v3.1
- 9.8 CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS v2.0
- 9.3 HIGH
AV:N/AC:M/Au:N/C:C/I:C/A:C - EPSS
- 83.28% chance of exploitation in the next 30 days, 100th percentile
- CISA KEV
- added 2025-10-06
- Published
- 2010-10-27
- Updated
- 2025-10-22
Proof-of-concept exploits (3)
- http://www.exploit-db.com/exploits/15342
- http://www.exploit-db.com/exploits/15341
- http://www.exploit-db.com/exploits/15352
Metasploit modules (1)
ExploitDB entries (4)
- https://www.exploit-db.com/exploits/16509
- https://www.exploit-db.com/exploits/15352
- https://www.exploit-db.com/exploits/15342
- https://www.exploit-db.com/exploits/15341