CVE-2024-9394

Summary

An attacker could, via a specially crafted multipart response, execute arbitrary JavaScript under the resource://devtools origin. This could allow them to access cross-origin JSON content. This access is limited to "same site" documents by the Site Isolation feature on desktop clients, but full cross-origin access is possible on Android versions. This vulnerability affects Firefox < 131, Firefox ESR < 128.3, Firefox ESR < 115.16, Thunderbird < 128.3, and Thunderbird < 131.

Affected Software

VendorProductVersion RangeStatus
MozillaFirefoxunspecified < 131affected
MozillaFirefox ESRunspecified < 128.3affected
MozillaFirefox ESRunspecified < 115.16affected
MozillaThunderbirdunspecified < 128.3affected
MozillaThunderbirdunspecified < 131affected

Weaknesses

  • Cross-origin access to JSON contents through multipart responses

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

CVE Program Container

Additional References

References