CVE-2024-10460

Description

The origin of an external protocol handler prompt could have been obscured using a data: URL within an `iframe`. This vulnerability affects Firefox < 132, Firefox ESR < 128.4, Thunderbird < 128.4, and Thunderbird < 132.

Reserved 2024-10-28 | Published 2024-10-29 | Updated 2024-10-31 | Assigner mozilla

Problem types

Confusing display of origin for external protocol handler prompt

Product status

Any version before 132
affected

Any version before 128.4
affected

Any version before 128.4
affected

Any version before 132
affected

Credits

Shaheen Fazim

References

bugzilla.mozilla.org/show_bug.cgi?id=1912537

www.mozilla.org/security/advisories/mfsa2024-55/

www.mozilla.org/security/advisories/mfsa2024-56/

www.mozilla.org/security/advisories/mfsa2024-58/

www.mozilla.org/security/advisories/mfsa2024-59/

cve.org (CVE-2024-10460)

nvd.nist.gov (CVE-2024-10460)

Download JSON