CVE-2007-3670Internet Explorer XSS
Argument injection vulnerability in Microsoft Internet Explorer, when running on systems with Firefox installed and certain URIs registered, allows remote attackers to conduct cross-browser scripting attacks and execute arbitrary commands via shell metacharacters in a (1)…
Published Jul 10, 2007 · Updated Apr 22, 2026
Key Facts
Routine patching- CVE-2007-3670 is a medium-severity vulnerability (CVSS 4.3 v2) affecting Internet Explorer (Microsoft), Firefox (Mozilla), firefox-esr-branding-upstream (suse) and 11 more products.
- It is not listed in any known-exploited vulnerabilities catalog. Public exploit code is available.
- EPSS estimates a 29% probability of exploitation in the next 30 days.
- Fixed versions are available, including firefox-esr 128.5.1-1.1, firefox-esr-branding-upstream 128.5.1-1.1, firefox-esr-translations-common 128.5.1-1.1.
- Brandefense priority: routine patching, as no exploitation is known and its severity is moderate or low.
Scores
CVSS v2
4.3
AV:N/AC:M/Au:N/C:N/I:P/A:N
EPSS (30-day exploit likelihood)
29%
Higher than 98.1% of all scored CVEs
Exploit maturity
Proof of concept
ATLAS score
35/100
Publication score, see How it works
Exploitation Verdict
KEV listed
Not listed
Federal due date
None
No federal due date
Ransomware use
Not reported
Attributed actors
None named
Exploit & Defence Guidance
Exploit maturity
Proof of concept
Public exploit code
1
Proof-of-concept links
In-the-wild evidence
0
Reports of active use
Description
Argument injection vulnerability in Microsoft Internet Explorer, when running on systems with Firefox installed and certain URIs registered, allows remote attackers to conduct cross-browser scripting attacks and execute arbitrary commands via shell metacharacters in a (1) FirefoxURL or (2) FirefoxHTML URI, which are inserted into the command line that is created when invoking firefox.exe. NOTE: it has been debated as to whether the issue is in Internet Explorer or Firefox.
As of 20070711, it is CVE's opinion that IE appears to be failing to properly delimit the URL argument when invoking Firefox, and this issue could arise with other protocol handlers in IE as well. However, Mozilla has stated that it will address the issue with a "defense in depth" fix that will "prevent IE from sending Firefox malicious data."
Affected Products
19 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| Internet ExplorerMicrosoft | 6, 6-sp1, 7.0, 7.0-beta1, 7.0-beta2, 7.0-beta3 | n/a |
| FirefoxMozilla | See advisory | n/a |
| firefox-esr-branding-upstreamsuse | See advisory | 128.5.1-1.1 |
| firefox-esrsuse | See advisory | 128.5.1-1.1 |
| firefox-esr-translations-commonsuse | See advisory | 128.5.1-1.1 |
Patched Releases
firefox-esr
128.5.1-1.1
firefox-esr-branding-upstream
128.5.1-1.1
firefox-esr-translations-common
128.5.1-1.1
firefox-esr-translations-other
128.5.1-1.1
MozillaFirefox
92.0-1.2
MozillaFirefox-branding-upstream
92.0-1.2
MozillaFirefox-devel
92.0-1.2
MozillaFirefox-translations-common
92.0-1.2
MozillaFirefox-translations-other
92.0-1.2
MozillaThunderbird
91.1.1-1.1
MozillaThunderbird-translations-common
91.1.1-1.1
MozillaThunderbird-translations-other
91.1.1-1.1
Timeline
Publicly disclosed
Jul 10, 2007
Last updated
Apr 22, 2026
Weakness Type
- CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
FAQ
Common Questions.
Argument injection vulnerability in Microsoft Internet Explorer, when running on systems with Firefox installed and certain URIs registered, allows remote attackers to conduct cross-browser scripting attacks and execute arbitrary commands via shell metacharacters in a (1) FirefoxURL or (2) FirefoxHTML URI, which are i…
Affected: Internet Explorer (Microsoft) versions 6, 6-sp1, 7.0, 7.0-beta1, 7.0-beta2, 7.0-beta3; Firefox (Mozilla); firefox-esr-branding-upstream (suse), among others. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
Public exploit code is available.
Fixed versions are available, including firefox-esr 128.5.1-1.1, firefox-esr-branding-upstream 128.5.1-1.1, firefox-esr-translations-common 128.5.1-1.1.
Brandefense priority: routine patching, as no exploitation is known and its severity is moderate or low.
Is CVE-2007-3670 On Your Attack Surface?
Brandefense matches it against the products discovered on your perimeter and opens a finding the day a CVE like this is listed.
Request A Demo