CVE-2024-8381

CRITICAL

Firefox < 130 - Type Confusion

Title source: llm

Description

A potentially exploitable type confusion could be triggered when looking up a property name on an object being used as the `with` environment. This vulnerability affects Firefox < 130, Firefox ESR < 128.2, Firefox ESR < 115.15, Thunderbird < 128.2, and Thunderbird < 115.15.

Exploits (1)

nomisec WORKING POC 15 stars

by bjrjk · poc

https://github.com/bjrjk/CVE-2024-8381

View Code ZIP pw:eip

References (8)

[Issue Tracking, Permissions Required] https://bugzilla.mozilla.org/show_bug.cgi?id=1912715

[Vendor Advisory] https://www.mozilla.org/security/advisories/mfsa2024-39/

[Vendor Advisory] https://www.mozilla.org/security/advisories/mfsa2024-40/

[Vendor Advisory] https://www.mozilla.org/security/advisories/mfsa2024-41/

[Mailing List] https://lists.debian.org/debian-lts-announce/2024/09/msg00012.html

[Mailing List] https://lists.debian.org/debian-lts-announce/2024/09/msg00025.html

[Vendor Advisory] https://www.mozilla.org/security/advisories/mfsa2024-43/

[Vendor Advisory] https://www.mozilla.org/security/advisories/mfsa2024-44/

Scores

CVSS v3 9.8

EPSS 0.1162

EPSS Percentile 93.7%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE

CWE-843

Status published

Products (2)

mozilla/firefox < 130.0

mozilla/firefox_esr < 115.15

Published Sep 03, 2024

Tracked Since Feb 18, 2026