CVE-2010-3765

CRITICAL(9.8)KEVLikely Exploited

Mozilla Multiple Products Remote Code Execution Vulnerability

Description

CVE-2010-3765 is a critical memory corruption vulnerability in Mozilla Firefox, Thunderbird, and SeaMonkey that allows remote attackers to execute arbitrary code. The flaw resides in the nsCSSFrameConstructor::ContentAppended function where incorrect index tracking during the creation of multiple frames leads to memory corruption when JavaScript is enabled. With a CVSS v3.1 base score of 9.8, this vulnerability was actively exploited in the wild in October 2010 by the Belmoo malware campaign. CISA has added CVE-2010-3765 to the Known Exploited Vulnerabilities catalog, and its EPSS score of 87.45% at the 99th percentile confirms near-certain exploitation activity, underscoring the critical need for immediate remediation of affected Mozilla products.

KEV Information

Vendor
Mozilla
Product
Multiple Products
Date Added
October 6, 2025
Due Date
October 27, 2025
Required Action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CVSS Score

Vector String
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in Calculator
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
Exploitability Score
3.9
Impact Score
5.9

CWEs

CWE-119Buffer Overflow

Improper Restriction of Operations within the Bounds of a Memory Buffer

Affected Products

VendorProductVersion
mozillafirefox3.5; 3.5.1; 3.5.2; 3.5.3; 3.5.4; 3.5.5; 3.5.6; 3.5.7; 3.5.8; 3.5.9; 3.5.10; 3.5.11; 3.5.12; 3.5.13; 3.5.14; 3.6; 3.6.2; 3.6.3; 3.6.4; 3.6.6; 3.6.7; 3.6.8; 3.6.9; 3.6.10; 3.6.11
mozillathunderbird3.0.1; 3.0.2; 3.0.3; 3.0.4; 3.0.5; 3.0.6; 3.0.7; 3.0.8; 3.0.9; 3.1.1; 3.1.2; 3.1.3; 3.1.4; 3.1.5
mozillaseamonkey2.0; 2.0.1; 2.0.2; 2.0.3; 2.0.4; 2.0.5; 2.0.6; 2.0.7; 2.0.8; 2.0.9

References

Weakness Type

CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2010-3765 is classified under CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), which encompasses buffer errors that occur when software performs operations outside intended memory boundaries. In the affected Mozilla products, the nsCSSFrameConstructor component fails to properly restrict memory operations during frame construction, allowing writes to memory locations outside the intended buffer when JavaScript triggers specific DOM manipulation sequences through the appendChild method.

Learn more: CWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer

Impact Analysis

CVE-2010-3765 poses an extreme risk to organizations and individuals using affected Mozilla products. The vulnerability is remotely exploitable over the network (AV:N) with low attack complexity (AC:L), requiring no authentication (PR:N) and no user interaction beyond visiting a malicious web page (UI:N). Confidentiality (High): An attacker achieving arbitrary code execution can access all data available to the browser process, including stored passwords, session cookies, browsing history, and locally stored files. Integrity (High): Successful exploitation allows full code execution, enabling modification of local files, installation of persistent malware, and alteration of system configurations. Availability (High): The memory corruption can crash the browser or allow an attacker to terminate processes and deny service. With a CVSS score of 9.8 (Critical) and an EPSS score of 87.45%, the Mozilla Firefox vulnerability represents an actively exploited threat that demands immediate attention.

Exploit Maturity

CVE-2010-3765 exhibits maximum exploit maturity. Public exploit code is available through multiple sources, including Exploit-DB entry 15341, Exploit-DB entry 15342, and Exploit-DB entry 15352. CISA has confirmed active exploitation in the wild by adding this vulnerability to the Known Exploited Vulnerabilities catalog. The vulnerability was notably weaponized in October 2010 by the Belmoo malware campaign, which used specially crafted web pages to trigger the memory corruption and deploy malware payloads. The EPSS score of 87.45% at the 99th percentile indicates near-certain exploitation activity, placing it among the most actively exploited vulnerabilities tracked. This vulnerability exists because of a combination of incorrect index tracking and the appendChild method in the nsCSSFrameConstructor, which makes exploitation reliable and repeatable.

Remediation

  1. Apply vendor patches immediately. Mozilla released emergency updates addressing CVE-2010-3765. Upgrade Firefox to version 3.5.15 or 3.6.12 or later, Thunderbird to version 3.0.10 or 3.1.6, and SeaMonkey to version 2.0.10 or later. The CISA required action states to apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

  2. Upgrade affected product versions. Firefox versions 3.5.x through 3.5.14 and 3.6.x through 3.6.11, Thunderbird versions 3.0.x before 3.0.10 and 3.1.x before 3.1.6, and SeaMonkey versions 2.x before 2.0.10 are all vulnerable and must be updated.

  3. Implement interim mitigations if immediate patching is not possible. Disable JavaScript in affected browsers to prevent exploitation, as the vulnerability requires JavaScript to be enabled. Apply network-level protections such as web proxy filtering and intrusion detection rules targeting known exploit signatures.

  4. Conduct forensic investigation on systems that may have been exposed. Review web proxy logs and endpoint detection logs for indicators of compromise related to the Belmoo malware campaign. Check for unauthorized processes, unexpected network connections, and modified system files.

  5. Implement long-term memory safety practices. Transition to modern, actively supported browser versions that benefit from compiler-level memory protections such as ASLR, DEP, and stack canaries. Enable automatic updates to ensure timely patching of future memory corruption vulnerabilities.

Technical Details

CVE-2010-3765 is a memory corruption vulnerability in the Mozilla layout engine's frame construction subsystem. The CVSS v3.1 vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H reflects that the vulnerability is network-exploitable without authentication or user interaction, achieving maximum impact across confidentiality, integrity, and availability. The root cause lies in the nsCSSFrameConstructor::ContentAppended function, which handles the creation and insertion of layout frames when DOM elements are dynamically added via the appendChild JavaScript method. During this process, incorrect index tracking leads to operations on memory locations outside the intended buffer boundaries, consistent with CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer). An attacker can trigger this condition by constructing a malicious web page that uses JavaScript to manipulate the DOM in a specific sequence, causing the creation of multiple frames with inconsistent internal state. The resulting memory corruption allows an attacker to overwrite adjacent memory structures, including function pointers and return addresses, achieving arbitrary code execution within the context of the browser process.

Frequently Asked Questions

Is CVE-2010-3765 being actively exploited?

Yes. CVE-2010-3765 was actively exploited in the wild as early as October 2010 by the Belmoo malware campaign. CISA has confirmed active exploitation by including it in the Known Exploited Vulnerabilities catalog with a remediation deadline of October 27, 2025. The EPSS score of 87.45% at the 99th percentile further confirms widespread exploitation.

What products are affected by CVE-2010-3765?

CVE-2010-3765 affects Mozilla Firefox versions 3.5 through 3.5.14 and 3.6 through 3.6.11, Mozilla Thunderbird versions 3.0.1 through 3.0.9 and 3.1.1 through 3.1.5, and Mozilla SeaMonkey versions 2.0 through 2.0.9. All these products share the vulnerable nsCSSFrameConstructor component in the Mozilla layout engine.

How do I fix CVE-2010-3765?

Update to the patched versions: Firefox 3.5.15 or 3.6.12+, Thunderbird 3.0.10 or 3.1.6+, and SeaMonkey 2.0.10+. If patching is not immediately possible, disable JavaScript in the affected browser as a temporary mitigation, since the vulnerability requires JavaScript to be enabled.

How severe is CVE-2010-3765?

CVE-2010-3765 is rated Critical with a CVSS v3.1 base score of 9.8 out of 10. The vulnerability requires no authentication and no user interaction to exploit over the network, and successful exploitation results in complete compromise of confidentiality, integrity, and availability. Its EPSS score of 87.45% places it at the 99th percentile of exploitation likelihood.

CVSS Score

9.8
CRITICAL(9.8)

EPSS Score

EPSS Score83.28%
EPSS Percentile99.7%

Dates

PublishedOctober 28, 2010
Last ModifiedJune 16, 2026
StatusAnalyzed
CVSS Versionv3.1

Quick Links

Back to CVE Database

Need Help With Vulnerability Management?

Our security experts can help you prioritize and remediate vulnerabilities effectively.

Get in Touch