Vulnerability in Mozilla Firefox
CVE-2024-11694
Enhanced Tracking Protection's Strict mode may have inadvertently allowed a CSP `frame-src` bypass and DOM-based XSS through the Google SafeFrame shim in the Web Compatibility extension. This issue could have exposed users to malicious fra…
EPSS: 0.001 (35.1th percentile) — read the EPSS interpretation.
Affected products
- Mozilla Firefox — versions unspecified
- Mozilla Firefox Esr — versions unspecified
- Mozilla Thunderbird — versions unspecified
Public proof-of-concept exploits
References
- bugzilla.mozilla.org/show_bug.cgi
- www.mozilla.org/security/advisories/mfsa2024-63/
- www.mozilla.org/security/advisories/mfsa2024-64/
- www.mozilla.org/security/advisories/mfsa2024-65/
- www.mozilla.org/security/advisories/mfsa2024-67/
- www.mozilla.org/security/advisories/mfsa2024-68/
- www.mozilla.org/security/advisories/mfsa2024-70/
Frequently asked questions
- What is CVE-2024-11694?
- CVE-2024-11694 is a vulnerability in Mozilla Firefox. Published 2024-11-26.
- Is CVE-2024-11694 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.