CVE-2024-9394: An attacker could, via a specially crafted multipart response, execute arbitrary JavaScript under the `resource://devtools` origin

Description

An attacker could, via a specially crafted multipart response, execute arbitrary JavaScript under the `resource://devtools` origin. This could allow them to access cross-origin JSON content. This access is limited to "same site" documents by the Site Isolation feature on desktop clients, but full cross-origin access is possible on Android versions. This vulnerability affects Firefox < 131, Firefox ESR < 128.3, Firefox ESR < 115.16, Thunderbird < 128.3, and Thunderbird < 131.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack vector

Network

Complexity

Low

Privileges

None

User interaction

None

Confidentiality

High

Integrity

None

Availability

None

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)0.5% · higher than 44% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

FI

Firefox · Mozilla

before 131.0 · source: NVD

FE

Firefox Esr · Mozilla

before 115.16.0; 116.0 before 128.3.0 · source: NVD

TH

Thunderbird · Mozilla

before 128.3; 129.0; 129.0; 129.0; 129.0; 129.0; +1 more · source: NVD