Read the docs
TI-2009-03889 Aliases CVE-2009-4100GHSA-f998-p46x-w444

Yoono extension before 6.1.1 for Firefox performs certain operations with chrome…

Priority MEDIUM 47CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Medium
Impact type
—
Confidentiality · integrity · availability
Complete · Complete · Complete
Fix status
No fix listed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA.

Summary

Yoono extension before 6.1.1 for Firefox performs certain operations with chrome privileges, which allows user-assisted remote attackers to execute arbitrary commands and perform cross-domain scripting attacks via DOM event handlers such as onload.

Why it matters now

EPSS 0.03871 90th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 34

CPEVersionsRoleVendor
cpe:2.3:a:yoono:yoono:*:*:*:*:*:*:*:*up to 6.1.0VulnerableYoono
cpe:2.3:a:yoono:yoono:2.0.2.474:*:*:*:*:*:*:*2.0.2.474VulnerableYoono
cpe:2.3:a:yoono:yoono:2.0.3.564:*:*:*:*:*:*:*2.0.3.564VulnerableYoono
cpe:2.3:a:yoono:yoono:2.0.4.641:*:*:*:*:*:*:*2.0.4.641VulnerableYoono
cpe:2.3:a:yoono:yoono:2.1.0.743:*:*:*:*:*:*:*2.1.0.743VulnerableYoono
cpe:2.3:a:yoono:yoono:2.2.1.1038:*:*:*:*:*:*:*2.2.1.1038VulnerableYoono
cpe:2.3:a:yoono:yoono:3.0.0.1268:*:*:*:*:*:*:*3.0.0.1268VulnerableYoono
cpe:2.3:a:yoono:yoono:3.0.0.1270:*:*:*:*:*:*:*3.0.0.1270VulnerableYoono
cpe:2.3:a:yoono:yoono:3.0.1.1388:*:*:*:*:*:*:*3.0.1.1388VulnerableYoono
cpe:2.3:a:yoono:yoono:3.0.2.1976:*:*:*:*:*:*:*3.0.2.1976VulnerableYoono
  • cpe:2.3:a:yoono:yoono:*:*:*:*:*:*:*:* Versions up to 6.1.0 Vulnerable ·Yoono
  • cpe:2.3:a:yoono:yoono:2.0.2.474:*:*:*:*:*:*:* Versions 2.0.2.474 Vulnerable ·Yoono
  • cpe:2.3:a:yoono:yoono:2.0.3.564:*:*:*:*:*:*:* Versions 2.0.3.564 Vulnerable ·Yoono
  • cpe:2.3:a:yoono:yoono:2.0.4.641:*:*:*:*:*:*:* Versions 2.0.4.641 Vulnerable ·Yoono
  • cpe:2.3:a:yoono:yoono:2.1.0.743:*:*:*:*:*:*:* Versions 2.1.0.743 Vulnerable ·Yoono
  • cpe:2.3:a:yoono:yoono:2.2.1.1038:*:*:*:*:*:*:* Versions 2.2.1.1038 Vulnerable ·Yoono
  • cpe:2.3:a:yoono:yoono:3.0.0.1268:*:*:*:*:*:*:* Versions 3.0.0.1268 Vulnerable ·Yoono
  • cpe:2.3:a:yoono:yoono:3.0.0.1270:*:*:*:*:*:*:* Versions 3.0.0.1270 Vulnerable ·Yoono
  • cpe:2.3:a:yoono:yoono:3.0.1.1388:*:*:*:*:*:*:* Versions 3.0.1.1388 Vulnerable ·Yoono
  • cpe:2.3:a:yoono:yoono:3.0.2.1976:*:*:*:*:*:*:* Versions 3.0.2.1976 Vulnerable ·Yoono
Show 24 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:yoono:yoono:3.0.3.2369:*:*:*:*:*:*:*3.0.3.2369VulnerableYoono
cpe:2.3:a:yoono:yoono:3.0.4.2469:*:*:*:*:*:*:*3.0.4.2469VulnerableYoono
cpe:2.3:a:yoono:yoono:3.0.5.2626:*:*:*:*:*:*:*3.0.5.2626VulnerableYoono
cpe:2.3:a:yoono:yoono:3.0.6.2723:*:*:*:*:*:*:*3.0.6.2723VulnerableYoono
cpe:2.3:a:yoono:yoono:3.1.0.2898:*:*:*:*:*:*:*3.1.0.2898VulnerableYoono
cpe:2.3:a:yoono:yoono:3.1.1.2999:*:*:*:*:*:*:*3.1.1.2999VulnerableYoono
cpe:2.3:a:yoono:yoono:4.0.0.4529:*:*:*:*:*:*:*4.0.0.4529VulnerableYoono
cpe:2.3:a:yoono:yoono:4.0.1.4774:*:*:*:*:*:*:*4.0.1.4774VulnerableYoono
cpe:2.3:a:yoono:yoono:4.0.2.5149:*:*:*:*:*:*:*4.0.2.5149VulnerableYoono
cpe:2.3:a:yoono:yoono:4.0.3.5488:*:*:*:*:*:*:*4.0.3.5488VulnerableYoono
cpe:2.3:a:yoono:yoono:5.0.1.11511_11520:*:*:*:*:*:*:*5.0.1.11511_11520VulnerableYoono
cpe:2.3:a:yoono:yoono:5.0.3:*:*:*:*:*:*:*5.0.3VulnerableYoono
cpe:2.3:a:yoono:yoono:5.0.4:*:*:*:*:*:*:*5.0.4VulnerableYoono
cpe:2.3:a:yoono:yoono:5.0.5:*:*:*:*:*:*:*5.0.5VulnerableYoono
cpe:2.3:a:yoono:yoono:5.0.6:*:*:*:*:*:*:*5.0.6VulnerableYoono
cpe:2.3:a:yoono:yoono:5.0.7:*:*:*:*:*:*:*5.0.7VulnerableYoono
cpe:2.3:a:yoono:yoono:5.0.7.2:*:*:*:*:*:*:*5.0.7.2VulnerableYoono
cpe:2.3:a:yoono:yoono:5.1.0:*:*:*:*:*:*:*5.1.0VulnerableYoono
cpe:2.3:a:yoono:yoono:5.2.0:*:*:*:*:*:*:*5.2.0VulnerableYoono
cpe:2.3:a:yoono:yoono:5.3.0:*:*:*:*:*:*:*5.3.0VulnerableYoono
cpe:2.3:a:yoono:yoono:5.4.0:*:*:*:*:*:*:*5.4.0VulnerableYoono
cpe:2.3:a:yoono:yoono:6.0.0:*:*:*:*:*:*:*6.0.0VulnerableYoono
cpe:2.3:a:yoono:yoono:6.0.1:*:*:*:*:*:*:*6.0.1VulnerableYoono
cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*all versionsRunning onMozilla
  • cpe:2.3:a:yoono:yoono:3.0.3.2369:*:*:*:*:*:*:* Versions 3.0.3.2369 Vulnerable ·Yoono
  • cpe:2.3:a:yoono:yoono:3.0.4.2469:*:*:*:*:*:*:* Versions 3.0.4.2469 Vulnerable ·Yoono
  • cpe:2.3:a:yoono:yoono:3.0.5.2626:*:*:*:*:*:*:* Versions 3.0.5.2626 Vulnerable ·Yoono
  • cpe:2.3:a:yoono:yoono:3.0.6.2723:*:*:*:*:*:*:* Versions 3.0.6.2723 Vulnerable ·Yoono
  • cpe:2.3:a:yoono:yoono:3.1.0.2898:*:*:*:*:*:*:* Versions 3.1.0.2898 Vulnerable ·Yoono
  • cpe:2.3:a:yoono:yoono:3.1.1.2999:*:*:*:*:*:*:* Versions 3.1.1.2999 Vulnerable ·Yoono
  • cpe:2.3:a:yoono:yoono:4.0.0.4529:*:*:*:*:*:*:* Versions 4.0.0.4529 Vulnerable ·Yoono
  • cpe:2.3:a:yoono:yoono:4.0.1.4774:*:*:*:*:*:*:* Versions 4.0.1.4774 Vulnerable ·Yoono
  • cpe:2.3:a:yoono:yoono:4.0.2.5149:*:*:*:*:*:*:* Versions 4.0.2.5149 Vulnerable ·Yoono
  • cpe:2.3:a:yoono:yoono:4.0.3.5488:*:*:*:*:*:*:* Versions 4.0.3.5488 Vulnerable ·Yoono
  • cpe:2.3:a:yoono:yoono:5.0.1.11511_11520:*:*:*:*:*:*:* Versions 5.0.1.11511_11520 Vulnerable ·Yoono
  • cpe:2.3:a:yoono:yoono:5.0.3:*:*:*:*:*:*:* Versions 5.0.3 Vulnerable ·Yoono
  • cpe:2.3:a:yoono:yoono:5.0.4:*:*:*:*:*:*:* Versions 5.0.4 Vulnerable ·Yoono
  • cpe:2.3:a:yoono:yoono:5.0.5:*:*:*:*:*:*:* Versions 5.0.5 Vulnerable ·Yoono
  • cpe:2.3:a:yoono:yoono:5.0.6:*:*:*:*:*:*:* Versions 5.0.6 Vulnerable ·Yoono
  • cpe:2.3:a:yoono:yoono:5.0.7:*:*:*:*:*:*:* Versions 5.0.7 Vulnerable ·Yoono
  • cpe:2.3:a:yoono:yoono:5.0.7.2:*:*:*:*:*:*:* Versions 5.0.7.2 Vulnerable ·Yoono
  • cpe:2.3:a:yoono:yoono:5.1.0:*:*:*:*:*:*:* Versions 5.1.0 Vulnerable ·Yoono
  • cpe:2.3:a:yoono:yoono:5.2.0:*:*:*:*:*:*:* Versions 5.2.0 Vulnerable ·Yoono
  • cpe:2.3:a:yoono:yoono:5.3.0:*:*:*:*:*:*:* Versions 5.3.0 Vulnerable ·Yoono
  • cpe:2.3:a:yoono:yoono:5.4.0:*:*:*:*:*:*:* Versions 5.4.0 Vulnerable ·Yoono
  • cpe:2.3:a:yoono:yoono:6.0.0:*:*:*:*:*:*:* Versions 6.0.0 Vulnerable ·Yoono
  • cpe:2.3:a:yoono:yoono:6.0.1:*:*:*:*:*:*:* Versions 6.0.1 Vulnerable ·Yoono
  • cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:* Versions all versions Running on ·Mozilla

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2009-4100
  2. 2026-10-03 Alias added: GHSA-f998-p46x-w444
  3. 2026-10-14 EPSS moved to the 90th–95th percentile

References

Advisory 1

Other 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences