Interestingly enough, I just checked a system with Snow Leopard using Safari and Firefox and it seems that both do not have this vulnerability.

I can't say when this was introduced, but if it is in Mavericks, it must have gotten there sometime between Lion and Mountain Lion.