CVE-2013-1670: The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 21.0, Firefox ESR 17.x before 17.0.6, Thunde…

Is it exploited?

Reported, not confirmed by CISA. VulnCheck KEV lists it as exploited in the wild. CISA has not added it to its Known Exploited Vulnerabilities catalog as of 29 Oct 2026.

VulnCheck KEV lists it since 9 Jan 2017. It cites 1 public report, the first from 9 Jan 2017.

• trustwave.com

How likely is exploitation in the next 30 days?

12%

Up from 10.9% on 23 Oct 2026.

EPSS score, percentile 96.1 of all scored records. A probability estimated by FIRST, not a report of exploitation.

How severe?

Not scored

The CVE record carries no CVSS score.

What should I do?

CISA has set no required action, because the vulnerability is not in KEV.

Advisories and patches (11)

Which versions are affected?

Not stated. The CVE record gives vendor and product as “n/a” and the version as “unspecified”.

Source: CISA KEV 2026.10.29, as of 29 Oct 2026; VulnCheck KEV, as of 30 Oct 2026; FIRST EPSS, as of 30 Oct 2026; CVE List, as of 30 Oct 2026. About the data.

Description

The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 21.0, Firefox ESR 17.x before 17.0.6, Thunderbird before 17.0.6, and Thunderbird ESR 17.x before 17.0.6 does not prevent acquisition of chrome privileges during calls to content level constructors, which allows remote attackers to bypass certain read-only restrictions and conduct cross-site scripting (XSS) attacks via a crafted web site.

Source: CVE List, as of 30 Oct 2026. About the data.

What to do

Advisories and patches

• DSA-2699 (Vendor advisory)
• MDVSA-2013:165 (Vendor advisory)
• openSUSE-SU-2013:0825 (Vendor advisory)
• USN-1823-1 (Vendor advisory)
• RHSA-2013:0821 (Vendor advisory)
• openSUSE-SU-2013:0929 (Vendor advisory)
• openSUSE-SU-2013:0831 (Vendor advisory)
• RHSA-2013:0820 (Vendor advisory)
• openSUSE-SU-2013:0834 (Vendor advisory)
• openSUSE-SU-2013:0946 (Vendor advisory)
• USN-1822-1 (Vendor advisory)

This summary is based on the CVE record as of 30 Oct 2026. Check the vendor's advisory before you act: affected versions and fixes can change.

Affected products and versions

The CVE record does not name affected products or versions: vendor and product are “n/a” and the version is “unspecified”.

Source: CVE List, as of 30 Oct 2026. About the data.

Timeline

Known exploited Mozilla vulnerabilities

• CVE-2010-3765: Mozilla Multiple Products Remote Code Execution Vulnerability (added 6 Oct 2025)
• CVE-2024-9680: Mozilla Firefox Use-After-Free Vulnerability (added 15 Oct 2024)
• CVE-2016-9079: Mozilla Firefox, Firefox ESR, and Thunderbird Use-After-Free Vulnerability (added 22 Jun 2023)
• CVE-2015-4495: Mozilla Firefox Security Feature Bypass Vulnerability (added 25 May 2022)
• CVE-2019-11707: Mozilla Firefox and Thunderbird Type Confusion Vulnerability (added 23 May 2022)