Firefox CVE-2010-3765: 2010 Zero-Day Added to KEV in 2025

What to do

1. Query your software inventory for Firefox, Thunderbird or SeaMonkey versions below 4.0, including copies inside VM templates and kiosk images.
2. Upgrade any hit to a current Firefox, Firefox ESR, Thunderbird or SeaMonkey release, or uninstall it.
3. If a legacy application pins a 2010-era Mozilla build, block it from browsing the web and from loading remote content, and plan its replacement.
4. Where an old build must run briefly, disable JavaScript, which Mozilla gave as the interim workaround in 2010.

How to check if you are affected or compromised

• Run firefox --version, thunderbird --version or seamonkey --version on Linux and macOS hosts, or read the file version of firefox.exe on Windows, and flag anything in the 3.x range.
• Review AV and EDR history on any host found running a 2010-era Mozilla build for unexpected child processes of the browser.
• Treat a legacy host that browsed the open web with these versions as untrusted and rebuild it rather than patch it in place.

What happened#

On October 26, 2010, the Mozilla Security Blog warned of a critical Firefox vulnerability, saying "exploit code leveraging this vulnerability has been detected in the wild." The trojan that used it "was initially reported as live on the Nobel Peace Prize site." The SANS Internet Storm Center flagged the same 0-day that day.

Mozilla shipped fixes the next day. Advisory MFSA 2010-73 calls the bug a heap buffer overflow when mixing document.write and DOM insertion. It credits Morten Kråkvik of Telenor SOC, who found the exploit while investigating an intrusion attempt on a customer network. The exploit targeted "particular versions of Firefox 3.6 on Windows XP," but the flaw itself affected all platforms. The CVE record traces the memory corruption to nsCSSFrameConstructor::ContentAppended. It says the bug was "exploited in the wild in October 2010 by the Belmoo malware."

Fifteen years later, on October 6, 2025, CISA added it to KEV "based on evidence of active exploitation." It was one of seven additions that day, alongside other old Internet Explorer and Windows bugs and a 2025 Oracle E-Business Suite flaw. Federal agencies had until October 27, 2025. The KEV entry points to MFSA 2010-73 for the fix. CISA's enrichment on NVD scores it CVSS 3.1 9.8.

Who is affected#

Firefox 3.5 through 3.5.14 and 3.6 through 3.6.11, Thunderbird before 3.0.10 and 3.1.6, and SeaMonkey 2.x before 2.0.10. JavaScript must be enabled. For Thunderbird, Mozilla said that "reading mail in Thunderbird does not pose a risk." The bug could be reached through RSS feeds with JavaScript on, or through add-ons that add browser features. Mozilla ended support for Firefox 3.6 on April 24, 2012, with 3.6.28 as the last release.

Do you really need to act?#

Almost certainly not. CISA did not say what evidence led to the 2025 listing. Security Affairs covered the batch but gave no current exploitation details for this CVE. We found no public report of new attacks as of October 23, 2026. The documented exploitation is the 2010 campaign.

Exploitation needs a Mozilla build from 2010 or earlier. Every Firefox since 3.6.12 has the fix, and current releases update themselves. The realistic exposure is a forgotten kiosk, a lab machine, or a frozen VM image still running Firefox 3.x. On such a machine this is one of hundreds of unpatched browser bugs, so the fix is replacement, not this one patch.

What to do now#

1. Query your inventory for Firefox, Thunderbird or SeaMonkey below version 4. On Linux and macOS, run firefox --version, thunderbird --version or seamonkey --version. On Windows, read the file version of firefox.exe.
2. Upgrade any hit to a current Firefox, Firefox ESR, Thunderbird or SeaMonkey release, or uninstall it.
3. If a legacy application depends on a 2010-era Mozilla build, block it from browsing the web and loading remote content. Plan its replacement.
4. If an old build must run in the meantime, disable JavaScript. That was Mozilla's interim workaround in 2010.

How to tell if you were hit#

A 2010 drive-by leaves little to find today, and no current indicators have been published. On any host still running a 2010-era Mozilla build, review AV and EDR history for unexpected child processes of the browser. If the host browsed the open web, treat it as untrusted and rebuild it.

Timeline#

• Oct 26, 2010 — Mozilla confirms in-the-wild exploitation tied to the Nobel Peace Prize site.
• Oct 27, 2010 — MFSA 2010-73 and fixed releases ship: Firefox 3.6.12 and 3.5.15, Thunderbird 3.1.6 and 3.0.10, SeaMonkey 2.0.10.
• Apr 24, 2012 — Firefox 3.6 reaches end of support.
• Oct 6, 2025 — CISA adds CVE-2010-3765 to KEV.
• Oct 27, 2025 — Federal remediation deadline.

Vulnerability records

• CVE-2010-3765 · KEV 2025-10-06 · Mozilla Firefox 3.5.x through 3.5.14 and 3.6.x through 3.6.11, Thunderbird 3.1.6 before 3.1.6 and 3.0.x before 3.0.10, and SeaMonkey 2.x before 2.0.10, when…

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. Mozilla — MFSA 2010-73: Heap buffer overflow mixing document.write and DOM insertion mozilla.org
2. Mozilla Security Blog — Critical vulnerability in Firefox 3.5 and Firefox 3.6 blog.mozilla.org
3. CVE record — CVE-2010-3765 cve.org
4. NVD — CVE-2010-3765 nvd.nist.gov
5. CISA — Known Exploited Vulnerabilities: CVE-2010-3765 cisa.gov
6. CISA — CISA Adds Seven Known Exploited Vulnerabilities to Catalog (Oct 6, 2025) cisa.gov
7. Mozilla Future Releases — Upcoming Firefox Support Changes (Firefox 3.6 end of support) blog.mozilla.org
8. SANS Internet Storm Center — Firefox news (Oct 26, 2010) isc.sans.edu

Coverage and analysis

1. Security Affairs — U.S. CISA adds Oracle, Mozilla, Microsoft Windows, Linux Kernel, and Microsoft IE flaws to its KEV catalog securityaffairs.com