CVE-2024-9392

Description

A compromised content process could have allowed for the arbitrary loading of cross-origin pages. This vulnerability affects Firefox < 131, Firefox ESR < 128.3, Firefox ESR < 115.16, Thunderbird < 128.3, and Thunderbird < 131.

Reserved 2024-10-01 | Published 2024-10-01 | Updated 2024-10-01 | Assigner mozilla

Problem types

Compromised content process can bypass site isolation

Product status

Any version before 131
affected

Any version before 128.3
affected

Any version before 115.16
affected

Any version before 128.3
affected

Any version before 131
affected

Credits

Jan Drescher and David Klein from IAS, TU Braunschweig

References

bugzilla.mozilla.org/show_bug.cgi?id=1899154

bugzilla.mozilla.org/show_bug.cgi?id=1905843

www.mozilla.org/security/advisories/mfsa2024-46/

www.mozilla.org/security/advisories/mfsa2024-47/

www.mozilla.org/security/advisories/mfsa2024-48/

www.mozilla.org/security/advisories/mfsa2024-49/

www.mozilla.org/security/advisories/mfsa2024-50/

cve.org (CVE-2024-9392)

nvd.nist.gov (CVE-2024-9392)

Download JSON