VYPR
Unrated severityNVD Advisory· Published Nov 9, 2011· Updated Apr 29, 2026

CVE-2011-3647

CVE-2011-3647

Description

The JSSubScriptLoader in Mozilla Firefox before 3.6.24 and Thunderbird before 3.1.6 does not properly handle XPCNativeWrappers during calls to the loadSubScript method in an add-on, which makes it easier for remote attackers to gain privileges via a crafted web site that leverages certain unwrapping behavior, a related issue to CVE-2011-3004.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

217
  • cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*+ 129 more
    • cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*range: <=3.6.23
    • cpe:2.3:a:mozilla:firefox:0.1:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:firefox:0.10:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:firefox:0.10.1:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:firefox:0.2:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:firefox:0.3:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:firefox:0.4:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:firefox:0.5:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:firefox:0.6:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:firefox:0.6.1:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:firefox:0.7:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:firefox:0.7.1:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:firefox:0.8:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:firefox:0.9:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:firefox:0.9.1:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:firefox:0.9.2:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:firefox:0.9.3:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:firefox:0.9:rc:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:firefox:1.0:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:firefox:1.0.1:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:firefox:1.0.2:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:firefox:1.0.3:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:firefox:1.0.4:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:firefox:1.0.5:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:firefox:1.0.6:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:firefox:1.0.7:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:firefox:1.0.8:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:firefox:1.0:preview_release:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:firefox:1.4.1:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:firefox:1.5:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:firefox:1.5.0.1:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:firefox:1.5.0.10:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:firefox:1.5.0.11:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:firefox:1.5.0.12:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:firefox:1.5.0.2:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:firefox:1.5.0.3:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:firefox:1.5.0.4:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:firefox:1.5.0.5:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:firefox:1.5.0.6:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:firefox:1.5.0.7:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:firefox:1.5.0.8:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:firefox:1.5.0.9:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:firefox:1.5.1:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:firefox:1.5.2:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:firefox:1.5.3:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:firefox:1.5.4:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:firefox:1.5.5:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:firefox:1.5.6:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:firefox:1.5.7:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:firefox:1.5.8:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:firefox:1.5:beta1:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:firefox:1.5:beta2:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:firefox:1.8:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:firefox:2.0:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:firefox:2.0.0.1:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:firefox:2.0.0.10:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:firefox:2.0.0.11:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:firefox:2.0.0.12:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:firefox:2.0.0.13:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:firefox:2.0.0.14:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:firefox:2.0.0.15:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:firefox:2.0.0.16:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:firefox:2.0.0.17:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:firefox:2.0.0.18:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:firefox:2.0.0.19:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:firefox:2.0.0.2:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:firefox:2.0.0.20:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:firefox:2.0.0.3:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:firefox:2.0.0.4:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:firefox:2.0.0.5:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:firefox:2.0.0.6:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:firefox:2.0.0.7:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:firefox:2.0.0.8:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:firefox:2.0.0.9:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:firefox:3.0:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:firefox:3.0.1:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:firefox:3.0.10:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:firefox:3.0.11:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:firefox:3.0.12:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:firefox:3.0.13:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:firefox:3.0.14:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:firefox:3.0.15:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:firefox:3.0.16:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:firefox:3.0.17:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:firefox:3.0.2:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:firefox:3.0.3:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:firefox:3.0.4:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:firefox:3.0.5:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:firefox:3.0.6:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:firefox:3.0.7:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:firefox:3.0.8:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:firefox:3.0.9:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:firefox:3.5:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:firefox:3.5.1:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:firefox:3.5.10:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:firefox:3.5.11:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:firefox:3.5.12:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:firefox:3.5.13:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:firefox:3.5.14:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:firefox:3.5.15:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:firefox:3.5.2:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:firefox:3.5.3:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:firefox:3.5.4:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:firefox:3.5.5:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:firefox:3.5.6:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:firefox:3.5.7:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:firefox:3.5.8:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:firefox:3.5.9:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:firefox:3.6:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:firefox:3.6.10:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:firefox:3.6.11:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:firefox:3.6.12:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:firefox:3.6.13:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:firefox:3.6.14:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:firefox:3.6.15:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:firefox:3.6.16:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:firefox:3.6.17:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:firefox:3.6.18:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:firefox:3.6.19:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:firefox:3.6.2:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:firefox:3.6.20:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:firefox:3.6.21:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:firefox:3.6.22:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:firefox:3.6.3:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:firefox:3.6.4:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:firefox:3.6.6:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:firefox:3.6.7:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:firefox:3.6.8:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:firefox:3.6.9:*:*:*:*:*:*:*
    • (no CPE)range: <3.6.24
  • cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*+ 86 more
    • cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*range: <=3.1.5
    • cpe:2.3:a:mozilla:thunderbird:0.1:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:0.2:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:0.3:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:0.4:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:0.5:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:0.6:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:0.7:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:0.7.1:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:0.7.2:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:0.7.3:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:0.8:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:0.9:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:1.0:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:1.0.1:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:1.0.2:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:1.0.3:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:1.0.4:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:1.0.5:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:1.0.5:beta:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:1.0.6:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:1.0.7:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:1.0.8:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:1.5:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:1.5.0.1:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:1.5.0.10:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:1.5.0.11:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:1.5.0.12:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:1.5.0.13:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:1.5.0.14:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:1.5.0.2:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:1.5.0.3:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:1.5.0.4:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:1.5.0.5:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:1.5.0.6:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:1.5.0.7:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:1.5.0.8:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:1.5.0.9:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:1.5.1:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:1.5.2:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:1.5:beta2:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:1.7.1:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:1.7.3:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:2.0:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:2.0.0.0:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:2.0.0.1:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:2.0.0.11:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:2.0.0.12:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:2.0.0.13:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:2.0.0.14:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:2.0.0.15:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:2.0.0.16:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:2.0.0.17:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:2.0.0.18:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:2.0.0.19:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:2.0.0.2:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:2.0.0.20:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:2.0.0.21:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:2.0.0.22:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:2.0.0.23:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:2.0.0.3:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:2.0.0.4:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:2.0.0.5:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:2.0.0.6:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:2.0.0.7:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:2.0.0.8:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:2.0.0.9:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:3.0:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:3.0.1:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:3.0.10:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:3.0.11:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:3.0.2:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:3.0.3:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:3.0.4:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:3.0.5:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:3.0.6:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:3.0.7:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:3.0.8:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:3.0.9:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:3.1:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:3.1.1:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:3.1.10:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:3.1.11:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:3.1.2:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:3.1.3:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:3.1.4:*:*:*:*:*:*:*
    • (no CPE)range: <3.1.6

Patches

Vulnerability mechanics

Root cause

"The parent chain of XPCNativeWrapper/SJOW reaches a content window on the 1.9.2 branch, allowing subscript code loaded via loadSubScript to bypass security wrappers and directly access content objects."

Attack vector

An attacker hosts a crafted web site that leverages the unsafe unwrapping behavior of `loadSubScript` when a content object is used as the scope parameter. On the 1.9.2 branch, the parent chain of XPCNativeWrapper/SJOW reaches a content window, so subscript code can directly access content objects — for example, `document` inside the subscript is not an XPCNativeWrapper, bypassing the security wrapper [ref_id=1]. This makes it easier for the attacker to escalate privileges from web content into the add-on's privileged context [CWE-20].

Affected code

The vulnerability resides in the JSSubScriptLoader component on the Mozilla 1.9.2 branch, specifically in the handling of XPCNativeWrappers during `loadSubScript` calls. The bug report identifies that the parent chain of XPCNativeWrapper/SJOW reaches a content window, allowing subscript code to directly access content objects without proper security wrapping [ref_id=1].

What the fix does

The bug report references that Firefox 7 and later are fixed by bug 653926, but the 1.9.2 branch required a separate fix. The patch (assigned to mrbkap) addresses the unsafe parent chain of XPCNativeWrapper/SJOW so that `loadSubScript` with a content object as the scope no longer allows subscript code to bypass security wrappers and directly access content objects [ref_id=1]. No patch diff is included in the bundle, but the advisory confirms the fix was applied to the 1.9.2 branch.

Preconditions

  • configUser must have an add-on installed that uses loadSubScript with a content object as the scope
  • networkAttacker must host a crafted web site that the victim visits
  • configVictim must use Firefox before 3.6.24 or Thunderbird before 3.1.6 on the 1.9.2 branch

Generated on May 25, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

5

News mentions

0

No linked articles in our index yet.