CVE-2024-7524

MEDIUM 6.1CVE-2024-7524 · Published 06/08/2024 · updated 17/06/2026

In short

CVE-2024-7524 is a MEDIUM (CVSS 6.1) vulnerability affecting firefox (mozilla), firefox esr (mozilla).
Chance of exploitation in the next 30 days (EPSS): 0.49%, higher than 42.1% of all vulnerabilities.
Fix: update to 129.0, 128.1, 115.14 or later.

Package	Affected versions	Patched versions
firefox mozilla	`< 129.0`	`129.0`
firefox esr mozilla	`≥ 116.0, < 128.1< 115.14`	`128.1115.14`

Description

Firefox adds web-compatibility shims in place of some tracking scripts blocked by Enhanced Tracking Protection. On a site protected by Content Security Policy in "strict-dynamic" mode, an attacker able to inject an HTML element could have used a DOM Clobbering attack on some of the shims and achieved XSS, bypassing the CSP strict-dynamic protection. This vulnerability affects Firefox < 129, Firefox ESR < 115.14, and Firefox ESR < 128.1.

References

bugzilla.mozilla.org/show_bug.cgi · Issue Tracking
mozilla.org/security/advisories/mfsa2024-33 · Vendor Advisory
mozilla.org/security/advisories/mfsa2024-34 · Vendor Advisory
mozilla.org/security/advisories/mfsa2024-35 · Vendor Advisory

More vulnerabilities in firefox

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

firefox

mozilla

< 129.0

129.0

firefox esr

mozilla

≥ 116.0, < 128.1< 115.14

128.1115.14

Description

More vulnerabilities in firefox

See all →