CVE-2024-11694

Summary

Enhanced Tracking Protection's Strict mode may have inadvertently allowed a CSP frame-src bypass and DOM-based XSS through the Google SafeFrame shim in the Web Compatibility extension. This issue could have exposed users to malicious frames masquerading as legitimate content. This vulnerability affects Firefox < 133, Firefox ESR < 128.5, Firefox ESR < 115.18, Thunderbird < 133, Thunderbird < 128.5, and Thunderbird < 115.18.

Affected Software

VendorProductVersion RangeStatus
MozillaFirefoxunspecified < 133affected
MozillaFirefox ESRunspecified < 128.5affected
MozillaFirefox ESRunspecified < 115.18affected
MozillaThunderbirdunspecified < 133affected
MozillaThunderbirdunspecified < 128.5affected
MozillaThunderbirdunspecified < 115.18affected

Weaknesses

  • CSP Bypass and XSS Exposure via Web Compatibility Shims

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

CVE Program Container

Additional References

References