Live › vulnerability › CVE-2013-1690
Go to dashboardMozilla Firefox and Thunderbird mishandle onreadystatechange events during page reloads, a flaw listed in CISA's Known Exploited Vulnerabilities catalog. A remote attacker who lures a user to a crafted web page can crash the browser or possibly run malicious code.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.
Apply updates per vendor instructions.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Mozilla Firefox and Thunderbird | vendor | – | – |
Check the installed Firefox or Thunderbird version against the vendor's fixed release; the sources do not give a specific version or command.
Update Firefox and Thunderbird to the current vendor release, as CISA requires; the sources do not name the fixed version.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before 17.0.7 do not properly handle onreadystatechange events in conjunction with page reloading, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted web site that triggers an attempt to execute data at an unmapped memory location.
This page as .md · .json · in your agent: get_signal("CVE-2013-1690")
CISA KEV catalog, Creative Commons 0 · EPSS scores by FIRST, used with attribution · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.