Search for vulnerabilities
Vulnerability details: VCID-pvbr-sspz-eufv
Vulnerability ID VCID-pvbr-sspz-eufv
Aliases CVE-2014-1510
Summary Security researcher Mariusz Mlynski, via TippingPoint's Pwn2Own contest, reported that it is possible for untrusted web content to load a chrome-privileged page by getting JavaScript-implemented WebIDL to call window.open(). A second bug allowed the bypassing of the popup-blocker without user interaction. Combined these two bugs allow an attacker to load a JavaScript URL that is executed with the full privileges of the browser, which allows arbitrary code execution. In general this flaw cannot be exploited through email in the Thunderbird and Seamonkey products because scripting is disabled, but is potentially a risk in browser or browser-like contexts.
Status Published
Exploitability 2.0
Weighted Severity 9.0
Risk 10.0
Affected and Fixed Packages Package Details
Weaknesses (0)
There are no known CWE.
System Score Found at
epss 0.75716 https://api.first.org/data/v1/epss?cve=CVE-2014-1510
epss 0.75716 https://api.first.org/data/v1/epss?cve=CVE-2014-1510
epss 0.75716 https://api.first.org/data/v1/epss?cve=CVE-2014-1510
epss 0.75716 https://api.first.org/data/v1/epss?cve=CVE-2014-1510
epss 0.75716 https://api.first.org/data/v1/epss?cve=CVE-2014-1510
epss 0.75716 https://api.first.org/data/v1/epss?cve=CVE-2014-1510
epss 0.75716 https://api.first.org/data/v1/epss?cve=CVE-2014-1510
epss 0.75716 https://api.first.org/data/v1/epss?cve=CVE-2014-1510
epss 0.75716 https://api.first.org/data/v1/epss?cve=CVE-2014-1510
epss 0.75716 https://api.first.org/data/v1/epss?cve=CVE-2014-1510
generic_textual critical https://www.mozilla.org/en-US/security/advisories/mfsa2014-29
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2014-1510.json
https://api.first.org/data/v1/epss?cve=CVE-2014-1510
1077490 https://bugzilla.redhat.com/show_bug.cgi?id=1077490
CVE-2014-1510 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1510
CVE-2014-1511;OSVDB-104594;CVE-2014-1510;OSVDB-104593 Exploit https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/multiple/remote/34448.rb
mfsa2014-29 https://www.mozilla.org/en-US/security/advisories/mfsa2014-29
RHSA-2014:0310 https://access.redhat.com/errata/RHSA-2014:0310
RHSA-2014:0316 https://access.redhat.com/errata/RHSA-2014:0316
USN-2150-1 https://usn.ubuntu.com/2150-1/
USN-2151-1 https://usn.ubuntu.com/2151-1/
Data source Metasploit
Description This exploit gains remote code execution on Firefox 22-27 by abusing two separate privilege escalation vulnerabilities in Firefox's Javascript APIs.
Note 
Reliability:
  - unknown-reliability
Stability:
  - unknown-stability
SideEffects:
  - unknown-side-effects
Ransomware campaign use Unknown
Source publication date March 17, 2014
Source URL https://github.com/rapid7/metasploit-framework/tree/master/modules/exploits/multi/browser/firefox_webidl_injection.rb
Data source Exploit-DB
Date added Aug. 28, 2014
Description Mozilla Firefox - WebIDL Privileged JavaScript Injection (Metasploit)
Ransomware campaign use Known
Source publication date Aug. 28, 2014
Exploit type remote
Platform multiple
Source update date Aug. 28, 2014
Exploit Prediction Scoring System (EPSS)
Percentile 0.98849
EPSS Score 0.75716
Published At Aug. 11, 2025, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2025-07-31T08:10:44.374417+00:00 Mozilla Importer Import https://github.com/mozilla/foundation-security-advisories/blob/master/announce/2014/mfsa2014-29.md 37.0.0