CVE-2006-0884

CVE-2006-0884 describes a critical vulnerability in Mozilla Thunderbird 1.0.7 and earlier, where its WYSIWYG rendering engine allows user-assisted attackers to bypass JavaScript security. By sending an email with a JavaScript URI in an IFRAME's SRC attribute, an attacker can execute arbitrary code, leading to information disclosure or application crashes when the user edits the email. This vulnerability carries a CVSS score of 9.3, indicating a high severity with network-based attacks and medium complexity, potentially resulting in complete compromise of confidentiality, integrity, and availability. While there is no evidence of active exploitation or Metasploit/Nuclei modules, an ExploitDB entry exists, and despite its age and high risk score, it has garnered minimal community discussion or media coverage.