What is CVE-2024-0605?

CVE-2024-0605 is a high-severity vulnerability in Mozilla Firefox Focus, classified under Concurrent Execution using Shared Resource with Improper Synchronization (Race Condition). CVSS score: 7.5/10. Published 2024-01-22.

How severe is CVE-2024-0605?

High severity. CVSS v3 base score is 7.5 out of 10.

Vulnerability in Mozilla Firefox Focus

CVE-2024-0605

Using a javascript: URI with a setTimeout race condition, an attacker can execute unauthorized scripts on top origin sites in urlbar. This bypasses security measures, potentially leading to arbitrary code execution or unauthorized actions within the user's loaded webpage. This vulnerability affects Focus for iOS < 122.

Vulnerability class: Race Condition

EPSS: 0.004 (31.8th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H.

Affected products

Mozilla Firefox_focus
Mozilla Focus For Ios — versions unspecified

Weakness classification (CWE)

CWE-362 — Concurrent Execution using Shared Resource with Improper Synchronization (Race Condition)

References

security@mozilla.org (Permissions Required, Issue Tracking)
security@mozilla.org (Vendor Advisory)

Frequently asked questions

What is CVE-2024-0605?: CVE-2024-0605 is a high-severity vulnerability in Mozilla Firefox Focus, classified under Concurrent Execution using Shared Resource with Improper Synchronization (Race Condition). CVSS score: 7.5/10. Published 2024-01-22.
How severe is CVE-2024-0605?: High severity. CVSS v3 base score is 7.5 out of 10.