CVE-2009-3374

CVE-2009-3374 describes a privilege escalation vulnerability in Mozilla Firefox versions 3.0.x before 3.0.15 and 3.5.x before 3.5.4. Specifically, the XPCVariant::VariantDataToJS function in the XPCOM implementation fails to properly restrict interactions between privileged chrome code and objects from remote websites. This flaw allows remote attackers to execute arbitrary JavaScript with chrome privileges through unspecified method calls involving "doubly-wrapped objects." The vulnerability carries a CVSS score of 7.5, indicating high severity. It is easily exploitable over the network with low attack complexity and no authentication required, potentially leading to partial compromise of confidentiality, integrity, and availability. There is no evidence of active exploitation, and no public exploit code (Metasploit, Nuclei, ExploitDB) is available. Community discussion and media coverage are minimal, suggesting low public awareness and attention to this particular CVE.