CVE-2014-1510: Mozilla Firefox Web IDL privilege escalation via window.open

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityCVSS 3.1 base score is 9.8 with no authentication or user interaction required, and the flaw crosses the browser's chrome privilege boundary.

What it is

The Web IDL implementation in Mozilla Firefox, Firefox ESR, Thunderbird and SeaMonkey mishandles privilege management, allowing an IDL fragment to trigger a window.open call that runs arbitrary JavaScript with chrome privileges. This breaks the browser's core security boundary between web content and privileged browser code, so a web page can reach the same trust level as the browser itself.

Impact

An attacker gains arbitrary JavaScript execution with chrome (browser-level) privileges, which can lead to reading local files, modifying browser internals, or further code execution in the user's context. The CVSS 3.1 vector rates confidentiality, integrity and availability impact all High.

Attack surface

Reachable remotely over the network with no authentication and no user interaction per the CVSS vector (AV:N/AC:L/PR:N/UI:N). The description states the trigger is an IDL fragment causing a window.open call, meaning a crafted web page or content is the delivery path.

Exploitation

Not listed in CISA KEV, but EPSS is very high (0.82339, 99.6th percentile) and a Mozilla Bugzilla reference is tagged Exploit, indicating public exploit-related material exists. No ransomware group usage is documented.

What to do

• Upgrade Firefox to 28.0 or later, Firefox ESR to 24.4 or later, Thunderbird to 24.4 or later, and SeaMonkey to 2.25 or later.
• Apply the vendor and distribution advisories (Mozilla MFSA 2014-29, Red Hat RHSA-2014-0310/0316, Debian DSA-2881/2911, Ubuntu USN-2151-1, openSUSE and SUSE announcements) for managed fleets.
• Retire or isolate end-of-life browser builds that cannot be patched, since this flaw affects the browser's privilege boundary.
• Where patching is delayed, restrict browsing to trusted sites and reduce exposure of privileged browser features.

Detection

• Monitor for browser crashes or abnormal window.open behavior originating from untrusted pages.
• Hunt for unexpected child processes or file access spawned by Firefox, Thunderbird or SeaMonkey, which would indicate chrome-privilege abuse.
• Track endpoint software inventory for Firefox, Thunderbird and SeaMonkey versions below the fixed releases listed above.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.