Read the docs
TI-2024-08716 Aliases CVE-2024-9394GHSA-qph8-rvxf-5936

Cross-site scripting in Mozilla Firefox

Priority LOW 33CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
High · None · None
Fix status
Partial Red Hat: 13 fixed, 4 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-79.

Summary

An attacker could, via a specially crafted multipart response, execute arbitrary JavaScript under the `resource://devtools` origin. This could allow them to access cross-origin JSON content. This access is limited to "same site" documents by the Site Isolation feature on desktop clients, but full cross-origin access is possible on Android versions. This vulnerability affects Firefox < 131, Firefox ESR < 128.3, Firefox ESR < 115.16, Thunderbird < 128.3, and Thunderbird < 131.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00521 44th percentileScored 2026-11-07
Fix Partial Firefox (Mozilla): 131Firefox ESR (Mozilla): 128.3, 115.16+1 more productRed Hat: 17 advisoriesRed Hat: 13 fixed, 4 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
MozillaFirefoxbefore 131131Patch availableCNA
MozillaFirefox ESRbefore 128.3128.3Patch availableCNA
MozillaFirefox ESRbefore 115.16115.16Patch availableCNA
MozillaThunderbirdbefore 128.3128.3Patch availableCNA
MozillaThunderbirdbefore 131131Patch availableCNA
  • Firefox VendorMozilla Affected before 131 Fixed in 131 Patch available CNA
  • Firefox ESR VendorMozilla Affected before 128.3 Fixed in 128.3 Patch available CNA
  • Firefox ESR VendorMozilla Affected before 115.16 Fixed in 115.16 Patch available CNA
  • Thunderbird VendorMozilla Affected before 128.3 Fixed in 128.3 Patch available CNA
  • Thunderbird VendorMozilla Affected before 131 Fixed in 131 Patch available CNA

CPE configurations NVD · 9

CPEVersionsRoleVendor
cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*before 131.0VulnerableMozilla
cpe:2.3:a:mozilla:firefox_esr:*:*:*:*:*:*:*:*before 115.16.0; 116.0 to before 128.3.0VulnerableMozilla
cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*before 128.3VulnerableMozilla
cpe:2.3:a:mozilla:thunderbird:129.0:beta:*:*:*:*:*:*129.0 betaVulnerableMozilla
cpe:2.3:a:mozilla:thunderbird:129.0:beta2:*:*:*:*:*:*129.0 beta2VulnerableMozilla
cpe:2.3:a:mozilla:thunderbird:129.0:beta3:*:*:*:*:*:*129.0 beta3VulnerableMozilla
cpe:2.3:a:mozilla:thunderbird:129.0:beta4:*:*:*:*:*:*129.0 beta4VulnerableMozilla
cpe:2.3:a:mozilla:thunderbird:129.0:beta5:*:*:*:*:*:*129.0 beta5VulnerableMozilla
cpe:2.3:a:mozilla:thunderbird:129.0:beta6:*:*:*:*:*:*129.0 beta6VulnerableMozilla
  • cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:* Versions before 131.0 Vulnerable ·Mozilla
  • cpe:2.3:a:mozilla:firefox_esr:*:*:*:*:*:*:*:* Versions before 115.16.0; 116.0 to before 128.3.0 Vulnerable ·Mozilla
  • cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:* Versions before 128.3 Vulnerable ·Mozilla
  • cpe:2.3:a:mozilla:thunderbird:129.0:beta:*:*:*:*:*:* Versions 129.0 beta Vulnerable ·Mozilla
  • cpe:2.3:a:mozilla:thunderbird:129.0:beta2:*:*:*:*:*:* Versions 129.0 beta2 Vulnerable ·Mozilla
  • cpe:2.3:a:mozilla:thunderbird:129.0:beta3:*:*:*:*:*:* Versions 129.0 beta3 Vulnerable ·Mozilla
  • cpe:2.3:a:mozilla:thunderbird:129.0:beta4:*:*:*:*:*:* Versions 129.0 beta4 Vulnerable ·Mozilla
  • cpe:2.3:a:mozilla:thunderbird:129.0:beta5:*:*:*:*:*:* Versions 129.0 beta5 Vulnerable ·Mozilla
  • cpe:2.3:a:mozilla:thunderbird:129.0:beta6:*:*:*:*:*:* Versions 129.0 beta6 Vulnerable ·Mozilla

Remediation

  • Fix · CNA Firefox (Mozilla) Fixed in 131
  • Fix · CNA Firefox ESR (Mozilla) Fixed in 128.3
  • Fix · CNA Firefox ESR (Mozilla) Fixed in 115.16
  • Fix · CNA Thunderbird (Mozilla) Fixed in 128.3
  • Fix · CNA Thunderbird (Mozilla) Fixed in 131

Red Hat 17 advisories

  • RHSA-2024:8166 Released 2024-10-16 · Red Hat rating Important
    thunderbird security update
    • Red Hat Enterprise Linux AppStream EUS (v.8.8) thunderbird-128.3.1-1.el8_8
  • RHSA-2024:8169 Released 2024-10-16 · Red Hat rating Important
    thunderbird security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.6) thunderbird-128.3.0-1.el8_6
    • Red Hat Enterprise Linux AppStream E4S (v.8.6) thunderbird-128.3.0-1.el8_6
    • Red Hat Enterprise Linux AppStream TUS (v.8.6) thunderbird-128.3.0-1.el8_6
  • RHSA-2024:7854 Released 2024-10-09 · Red Hat rating Important
    thunderbird security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.4) thunderbird-128.3.0-1.el8_4
    • Red Hat Enterprise Linux AppStream E4S (v.8.4) thunderbird-128.3.0-1.el8_4
    • Red Hat Enterprise Linux AppStream TUS (v.8.4) thunderbird-128.3.0-1.el8_4
Show 14 more Red Hat advisories
  • RHSA-2024:7856 Released 2024-10-09 · Red Hat rating Important
    thunderbird security update
    • Red Hat Enterprise Linux AppStream AUS (v. 8.2) thunderbird-128.3.0-1.el8_2
  • RHSA-2024:7853 Released 2024-10-09 · Red Hat rating Important
    thunderbird security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.2) thunderbird-128.3.0-1.el9_2
  • RHSA-2024:7855 Released 2024-10-09 · Red Hat rating Important
    thunderbird security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.0) thunderbird-128.3.0-1.el9_0
  • RHSA-2024:7842 Released 2024-10-09 · Red Hat rating Important
    firefox security update
    • Red Hat Enterprise Linux AppStream EUS (v.8.8) firefox-128.3.0-1.el8_8
  • RHSA-2024:7700 Released 2024-10-07 · Red Hat rating Important
    firefox security update
    • Red Hat Enterprise Linux AppStream (v. 8) firefox-128.3.0-1.el8_10
  • RHSA-2024:7699 Released 2024-10-07 · Red Hat rating Important
    thunderbird security update
    • Red Hat Enterprise Linux AppStream (v. 8) thunderbird-128.3.0-1.el8_10
  • RHSA-2024:7704 Released 2024-10-07 · Red Hat rating Important
    firefox security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.6) firefox-128.3.0-1.el8_6
    • Red Hat Enterprise Linux AppStream E4S (v.8.6) firefox-128.3.0-1.el8_6
    • Red Hat Enterprise Linux AppStream TUS (v.8.6) firefox-128.3.0-1.el8_6
  • RHSA-2024:7702 Released 2024-10-07 · Red Hat rating Important
    firefox security update
    • Red Hat Enterprise Linux Server (v. 7 ELS) firefox-128.3.0-1.el7_9
  • RHSA-2024:7703 Released 2024-10-07 · Red Hat rating Important
    firefox security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.4) firefox-128.3.0-1.el8_4
    • Red Hat Enterprise Linux AppStream E4S (v.8.4) firefox-128.3.0-1.el8_4
    • Red Hat Enterprise Linux AppStream TUS (v.8.4) firefox-128.3.0-1.el8_4
  • RHSA-2024:7646 Released 2024-10-03 · Red Hat rating Important
    firefox security update
    • Red Hat Enterprise Linux AppStream AUS (v. 8.2) firefox-128.3.0-1.el8_2
  • RHSA-2024:7622 Released 2024-10-03 · Red Hat rating Important
    firefox security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.2) firefox-128.3.0-1.el9_2, firefox-x11-128.3.0-1.el9_2
  • RHSA-2024:7621 Released 2024-10-03 · Red Hat rating Important
    firefox security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.0) firefox-128.3.0-1.el9_0
  • RHSA-2024:7552 Released 2024-10-02 · Red Hat rating Important
    thunderbird security update
    • Red Hat Enterprise Linux AppStream (v. 9) thunderbird-128.3.0-1.el9_4
  • RHSA-2024:7505 Released 2024-10-02 · Red Hat rating Important
    firefox security update
    • Red Hat Enterprise Linux AppStream (v. 9) firefox-128.3.0-1.el9_4, firefox-x11-128.3.0-1.el9_4

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Mozilla Firefox 131

    13 records Highest priority Priority MEDIUM 5 MEDIUM, 8 LOW

    Other records, highest priority first

    • TI-2024-08724 Memory corruption in Mozilla FirefoxPriority MEDIUM 50
    • TI-2024-08723 Memory corruption in Mozilla FirefoxPriority MEDIUM 50
    • TI-2024-08714 Origin validation error in Mozilla FirefoxPriority MEDIUM 50
    Show all 13 records →
  • Release ·

    Mozilla Thunderbird 131

    11 records Highest priority Priority MEDIUM 5 MEDIUM, 6 LOW

    Other records, highest priority first

    • TI-2024-08724 Memory corruption in Mozilla FirefoxPriority MEDIUM 50
    • TI-2024-08723 Memory corruption in Mozilla FirefoxPriority MEDIUM 50
    • TI-2024-08714 Origin validation error in Mozilla FirefoxPriority MEDIUM 50
    Show all 11 records →
Show 2 more groups
  • Release ·

    Mozilla Firefox ESR, Thunderbird 128.3

    10 records Highest priority Priority MEDIUM 5 MEDIUM, 5 LOW

    Other records, highest priority first

    • TI-2024-08724 Memory corruption in Mozilla FirefoxPriority MEDIUM 50
    • TI-2024-08723 Memory corruption in Mozilla FirefoxPriority MEDIUM 50
    • TI-2024-08714 Origin validation error in Mozilla FirefoxPriority MEDIUM 50
    Show all 10 records →
  • Release ·

    Mozilla Firefox ESR 115.16

    4 records Highest priority Priority MEDIUM 2 MEDIUM, 2 LOW

    Other records, highest priority first

    • TI-2024-08723 Memory corruption in Mozilla FirefoxPriority MEDIUM 50
    • TI-2024-08714 Origin validation error in Mozilla FirefoxPriority MEDIUM 50
    • TI-2024-08715 Origin validation error in Mozilla FirefoxPriority LOW 39
    Show all 4 records →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 10AffectedNo fix yet
Red Hat Enterprise Linux 6AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux 7AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux 9AffectedNo fix yet
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2024:7699, RHSA-2024:7700
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2024:7505, RHSA-2024:7552
Red Hat Enterprise Linux AppStream AUS (v. 8.2)Fixed RHSA-2024:7646, RHSA-2024:7856
Red Hat Enterprise Linux AppStream AUS (v.8.4)Fixed RHSA-2024:7703, RHSA-2024:7854
Red Hat Enterprise Linux AppStream AUS (v.8.6)Fixed RHSA-2024:7704, RHSA-2024:8169
Red Hat Enterprise Linux AppStream E4S (v.8.4)Fixed RHSA-2024:7703, RHSA-2024:7854
Red Hat Enterprise Linux AppStream E4S (v.8.6)Fixed RHSA-2024:7704, RHSA-2024:8169
Red Hat Enterprise Linux AppStream E4S (v.9.0)Fixed RHSA-2024:7621, RHSA-2024:7855
Red Hat Enterprise Linux AppStream EUS (v.8.8)Fixed RHSA-2024:7842, RHSA-2024:8166
Red Hat Enterprise Linux AppStream EUS (v.9.2)Fixed RHSA-2024:7622, RHSA-2024:7853
Red Hat Enterprise Linux AppStream TUS (v.8.4)Fixed RHSA-2024:7703, RHSA-2024:7854
Red Hat Enterprise Linux AppStream TUS (v.8.6)Fixed RHSA-2024:7704, RHSA-2024:8169
Red Hat Enterprise Linux Server (v. 7 ELS)Fixed RHSA-2024:7702

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-9394
  2. 2026-10-03 Alias added: GHSA-qph8-rvxf-5936

References

Advisory 5

Other 1

  • TI-2024-08981 Use after free in Mozilla Firefox KEVCVSS 3.1CRITICAL 9.8
  • TI-2022-09832 Use after free in Mozilla Firefox KEVCVSS 3.1CRITICAL 9.6
  • TI-2019-08769 Improper input validation in Mozilla Firefox ESR KEVCVSS 3.1CRITICAL 10.0
  • TI-2010-03577 Mozilla Firefox 3.5.x through 3.5.14 and 3.6.x through 3.6.11, Thunderbird 3.1.6 before… KEVCVSS 3.1CRITICAL 9.8
  • TI-2023-04799 Out-of-bounds write in Google Chrome KEVCVSS 3.1HIGH 8.8
  • TI-2023-04477 Out-of-bounds write in Google Chrome KEVCVSS 3.1HIGH 8.8
See all 3444 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences