Collected research

overwriting cookies on other people's domains in Firefox.

Mozilla's fix for CVE-2007-0981, where an embedded NUL in a hostname made same-origin and cookie-domain checks compare truncated strings, letting an attacker set or read another origin's cookies and script it. The landed patch rejects NULs in nsStandardURL::SetHost and BuildNormalizedSpec and validates schemes in nsSimpleURI, shipping in 1.8.0.10 and 1.8.1.2.

Record

Published by

bugzilla.mozilla.org

Topic

Identity

In the archive

• Collected in the 2007 research round

Related sources

• 370445 - (CVE-2007-0981) embedded nulls in location.hostname confuse same-origin checks (Zalewski XSS vulnerability)

Tags

• url-parsing
• sop-bypass
• same-origin-policy
• cookie
• xss
• cve
• vendor-advisory
• owasp-a01-2021
• owasp-a03-2021
• owasp-a07-2021

This page is the archive's own catalogue record. The research is the work of bugzilla.mozilla.org, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 9 August 2026.