Skip to content
Fencer Vulns
low 2.6

CVE-2004-1753 json

The Apple Java plugin, as used in Netscape 7.1 and 7.2, Mozilla 1.7.2, and Firefox 0.9.3 on MacOS X 10.3.5, when tabbed browsing is enabled…

published 2004-12-31 21 y ago modified 2026-06-16 4 mo ago also EUVD-2004-1747

cvss
2.6
version 2.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
1.6%
EPSS 1.6% chance of exploitation in 30 days, percentile 75%
public exploits
0
none known

Summary

The Apple Java plugin, as used in Netscape 7.1 and 7.2, Mozilla 1.7.2, and Firefox 0.9.3 on MacOS X 10.3.5, when tabbed browsing is enabled, does not properly handle SetWindow(NULL) calls, which allows Java applets from one tab to draw to other tabs and facilitates phishing attacks that spoof tabs.

Exploit prediction

1.60% chance of exploitation in the next 30 days, higher than 75% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • securityfocus.com http://www.securityfocus.com/archive/1/373309 referenced PoC, tagged "exploit" by a source, unverified
  • securityfocus.com http://www.securityfocus.com/archive/1/373080 referenced PoC, tagged "exploit" by a source, unverified
  • securityfocus.com http://www.securityfocus.com/archive/1/373232 referenced PoC, tagged "exploit" by a source, unverified
  • securityfocus.com http://www.securityfocus.com/bid/11059 referenced PoC, tagged "exploit" by a source, unverified
  • bugzilla.mozilla.org http://bugzilla.mozilla.org/show_bug.cgi?id=162134 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
NVD 2.0 2.6 AV:N/AC:H/Au:N/C:N/I:P/A:N

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.