CVE-2024-9392

The vulnerability stems from a violation of the origin isolation principle (CWE-346 — Origin Validation Error). Under normal circumstances, the same-origin policy mechanism prevents content processes from accessing resources from other domains. In the case of this vulnerability, a compromised content process can bypass this control and load arbitrary cross-origin pages, which opens the way for further abuse of the browser or email client environment.

An attacker who gains control over the content process can obtain unauthorized access to data from other pages and potentially affect their integrity and availability, which corresponds to a complete breach of confidentiality, integrity, and availability (CVSS C:H/I:H/A:H).

Software should be updated to the following versions: Firefox 131 or newer, Firefox ESR 128.3 or newer, Firefox ESR 115.16 or newer, Thunderbird 128.3 or newer, Thunderbird 131 or newer. Detailed information available in Mozilla security bulletins: mfsa2024-46, mfsa2024-47, mfsa2024-48.

Mozilla Firefox versions below 131, Mozilla Firefox ESR versions below 128.3 and below 115.16, Mozilla Thunderbird versions below 128.3 and below 131.