CVE-2024-6611

The attack exploits a nested iframe element that triggers cross-site navigation. Under normal circumstances, cookies with the SameSite=Strict or SameSite=Lax attribute should not be sent in requests initiated from other websites. However, a bug in the browser's logic causes SameSite restrictions to be bypassed in the described scenario, and cookies are included in the request despite crossing the origin boundary. This allows an attacker to carry out an attack from an external website with the victim's authentication.

An attacker can bypass SameSite cookie protections and send authenticated requests on behalf of the victim to other websites, effectively opening the door to Cross-Site Request Forgery (CSRF) attacks and unauthorized access to resources protected by the user's session.

Mozilla Firefox should be updated to version 128 or newer, and Mozilla Thunderbird should be updated to version 128 or newer. Patches have been described in official Mozilla security bulletins MFSA2024-29 and MFSA2024-32.

Mozilla Firefox in versions below 128 and Mozilla Thunderbird in versions below 128.