According to media reports, Firefox has developed a patch, but it has yet to be distributed to users.
News of the vulnerability came five days after Mozilla announced two "critical" flaws affecting Firefox.
Mozilla suggested users switch to plain text when emailing as the flaw only affects HTML composition.
The other bug, discovered through TippingPoint's Zero Day Initiative, is caused by "an invalid and nonsensical ordering of table-related tags," which could allow the attacker to run malicious code, a second company advisory said. Users should update to a fixed version to avoid potential problems.