CVE-2013-0753: Mozilla Firefox XMLSerializer use-after-free enables remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: high.

high priorityCVSS 2.0 is 9.3 with complete impact and EPSS is above the 98th percentile, but the flaw is old, fixed in 2013 releases, and not in KEV.

What it is

A use-after-free flaw exists in the serializeToStream implementation of the XMLSerializer component in Mozilla Firefox, Thunderbird and SeaMonkey. Crafted web content can trigger the freed memory to be reused, which the vendor and NVD describe as allowing remote code execution. The affected versions are Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderbird ESR 10.x before 10.0.12 and 17.x before 17.0.2, and SeaMonkey before 2.15.

Impact

An attacker who gets the crafted content rendered can execute arbitrary code in the context of the browser or mail client, giving full control of the affected process and its data. CVSS 2.0 scores confidentiality, integrity and availability impact as complete.

Attack surface

The vector is network-reachable (AV:N) with no authentication (Au:N), and the description states the trigger is crafted web content, so a victim must load or view that content. No user interaction beyond rendering the page or message is described.

Exploitation

The record is not listed in CISA KEV and no ransomware use is documented, but EPSS is 0.51324 (98.9th percentile), indicating a high modeled likelihood of exploitation activity. Reference tags are advisory, patch and issue-tracking only, so no public exploit code is confirmed by this record.

What to do

• Upgrade Firefox to 18.0 or later, Firefox ESR to 10.0.12 or 17.0.2 or later, Thunderbird to 17.0.2 or later, Thunderbird ESR to 10.0.12 or 17.0.2 or later, and SeaMonkey to 2.15 or later.
• Apply the vendor and distribution advisories referenced in the record (Mozilla MFSA 2013-16, Red Hat RHSA-2013-0144/0145, Ubuntu USN-1681-1/2/4, openSUSE security announcements) for packaged builds.
• If immediate upgrade is not possible, restrict browsing and mail rendering of untrusted content and disable or block script execution where policy allows.
• Retire or isolate end-of-life browser and mail client versions that cannot be patched to the fixed releases.

Detection

• Monitor for crashes in the browser or mail client process, particularly around XMLSerializer or serializeToStream, as use-after-free exploitation often produces crash telemetry.
• Hunt for unexpected child processes, shell execution or file writes originating from firefox, thunderbird or seamonkey processes.
• Check endpoint and proxy logs for known exploit-hosting or malvertising domains serving content to unpatched clients.
• Verify installed browser and mail client versions against the fixed releases and alert on any host still below them.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.