Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-jx4t-39du-9khz
Vulnerability ID VCID-jx4t-39du-9khz
Aliases CVE-2009-1840
Summary Mozilla add-on developer and community member Wladimir Palant reported that content-loading policies were not checked before loading external script files into XUL documents. The severity of this problem would depend on the reasons behind the content policy check, which include privacy from "web bugs" in Thunderbird mail messages, blocking of Ads and Ad-server tracking in AdBlock Plus.The original version of this advisory incorrectly claimed that NoScript protection could by bypassed; NoScript was unaffected.
Status Published
Exploitability None
Weighted Severity None
Risk None
Affected and Fixed Packages Package Details
Weaknesses (0)
There are no known CWE.
System Score Found at
epss 0.01388 https://api.first.org/data/v1/epss?cve=CVE-2009-1840
generic_textual low https://www.mozilla.org/en-US/security/advisories/mfsa2009-31
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2009-1840.json
https://api.first.org/data/v1/epss?cve=CVE-2009-1840
503582 https://bugzilla.redhat.com/show_bug.cgi?id=503582
CVE-2009-1840 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1840
GLSA-201301-01 https://security.gentoo.org/glsa/201301-01
mfsa2009-31 https://www.mozilla.org/en-US/security/advisories/mfsa2009-31
RHSA-2009:1095 https://access.redhat.com/errata/RHSA-2009:1095
USN-779-1 https://usn.ubuntu.com/779-1/
No exploits are available.
Exploit Prediction Scoring System (EPSS)
Percentile 0.80651
EPSS Score 0.01388
Published At May 29, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-05-29T08:27:38.780065+00:00 Mozilla Importer Import https://github.com/mozilla/foundation-security-advisories/blob/master/announce/2009/mfsa2009-31.md 38.6.0