The Chrome Object Wrapper (COW) and System Only Wrapper (SOW) implementations in Mozilla Firefox before 19.0, Firefox ESR 17.x before 17.0.3, Thunderbird before 17.0.3, Thunderbird ESR 17.x before 17.0.3, and SeaMonkey before 2.16 do not prevent modifications to a prototype, which allows remote attackers to obtain sensitive information from chrome objects or possibly execute arbitrary JavaScript code with chrome privileges via a crafted web site.
Conclusion & alert: CVE-2013-0773 is rated High Risk (66.6/100): CVSS Critical severity, with medium exploitation likelihood (EPSS 2.36%). Mandatory action: High exploitation likelihood—assess exposure and prioritize remediation.
Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.
EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).
| # | Date | Old EPSS score | New EPSS score | Delta (New - Old) |
|---|---|---|---|---|
| 1 | 2026-06-15 | 1.52% | 2.36% | +0.84% |
| 2 | 2025-08-23 | 1.09% | 1.52% | +0.43% |
| 3 | 2025-03-30 | — | 1.09% | — |
Full EPSS history (9 records total)
CVSS metrics for this CVE.
| Base score | Version | Severity | Vector | Exploitability | Impact | Score source |
|---|---|---|---|---|---|---|
| 9.3 | 2.0 | HIGH |
|
8.6 | 10.0 | [email protected] |
| vendor | priority | summary | link |
|---|---|---|---|
gentoo
|
high | CVE-2013-0773: 1 GLSA(s) (201309-23), 6 atom(s) (mail-client/thunderbird, mail-client/thunderbird-bin, www-client/firefox, www-client/firefox-bin, www-client/seamonkey, www-client/seamonkey-bin); latest impact high. | https://bugs.gentoo.org/buglist.cgi?quicksearch=CVE-2013-0773 |
redhat
|
medium | — | https://access.redhat.com/security/cve/CVE-2013-0773 |
suse
|
critical | CVE-2013-0773 severity critical: SUSE including 98 source package names (MozillaFirefox, MozillaFirefox-140.2.0-160000.1.2, …), 138 product×package rows across 35 product lines (SUSE Linux Enterprise Desktop 11 SP2, SUSE Linux Enterprise Desktop 12, … (35 product lines)): Fixed 137, Known Not Affected 1. | https://www.suse.com/security/cve/CVE-2013-0773/ |
ubuntu
|
medium | CVE-2013-0773 medium priority: Ubuntu including 5 source packages (firefox, seamonkey, thunderbird, xulrunner-1.9.2, xulrunner-2.0), 40 status rows across 8 suites (hardy, lucid, oneiric, precise, quantal, raring, saucy, upstream): DNE 16, released 11, ignored 7, not-affected 4, needs-triage 2. | https://ubuntu.com/security/CVE-2013-0773 |
| Vendor | Product | Version | Raw CPE |
|---|---|---|---|
| mozilla | firefox | < 17.0.3 | cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:* |
| mozilla | firefox | < 19.0 | cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:* |
| mozilla | seamonkey | < 2.16 | cpe:2.3:a:mozilla:seamonkey:*:*:*:*:*:*:*:* |
| mozilla | thunderbird | < 17.0.3 | cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:* |
| mozilla | thunderbird_esr | < 17.0.3 | cpe:2.3:a:mozilla:thunderbird_esr:*:*:*:*:*:*:*:* |
| opensuse | opensuse | 11.4 | cpe:2.3:o:opensuse:opensuse:11.4:*:*:*:*:*:*:* |
| opensuse | opensuse | 12.1 | cpe:2.3:o:opensuse:opensuse:12.1:*:*:*:*:*:*:* |
| opensuse | opensuse | 12.2 | cpe:2.3:o:opensuse:opensuse:12.2:*:*:*:*:*:*:* |
| debian | debian_linux | 7.0 | cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:* |
| canonical | ubuntu_linux | 10.04 | cpe:2.3:o:canonical:ubuntu_linux:10.04:*:*:*:-:*:*:* |
| canonical | ubuntu_linux | 11.10 | cpe:2.3:o:canonical:ubuntu_linux:11.10:*:*:*:*:*:*:* |
| canonical | ubuntu_linux | 12.04 | cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:esm:*:*:* |
| canonical | ubuntu_linux | 12.10 | cpe:2.3:o:canonical:ubuntu_linux:12.10:*:*:*:*:*:*:* |
| URL | Tags |
|---|---|
| http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00017.html | Mailing List Third Party Advisory |
| http://lists.opensuse.org/opensuse-updates/2013-02/msg00062.html | Mailing List Third Party Advisory |
| http://www.debian.org/security/2013/dsa-2699 | Third Party Advisory |
| http://www.mozilla.org/security/announce/2013/mfsa2013-24.html | Vendor Advisory |
| http://www.ubuntu.com/usn/USN-1729-1 | Third Party Advisory |
| http://www.ubuntu.com/usn/USN-1729-2 | Third Party Advisory |
| http://www.ubuntu.com/usn/USN-1748-1 | Third Party Advisory |
| https://bugzilla.mozilla.org/show_bug.cgi?id=809652 | Issue Tracking Patch Vendor Advisory |
| https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16861 | Third Party Advisory |