CVE-2024-9394

HIGH

Firefox < 131 and ESR < 115.16.0 - Cross-Site Scripting via Multipart Response

Title source: llm
STIX 2.1

Description

An attacker could, via a specially crafted multipart response, execute arbitrary JavaScript under the `resource://devtools` origin. This could allow them to access cross-origin JSON content. This access is limited to "same site" documents by the Site Isolation feature on desktop clients, but full cross-origin access is possible on Android versions. This vulnerability affects Firefox < 131, Firefox ESR < 128.3, Firefox ESR < 115.16, Thunderbird < 128.3, and Thunderbird < 131.

References (8)

Core 8

Scores

CVSS v3 7.5
EPSS 0.0016
EPSS Percentile 36.7%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-79
Status published
Products (4)
mozilla/firefox < 131.0
mozilla/firefox_esr < 115.16.0
mozilla/thunderbird 129.0 beta (6 CPE variants)
mozilla/thunderbird < 128.3
Published Oct 01, 2024
Tracked Since Feb 18, 2026