Homepage

Arbitrary Code Injection The advisory has been revoked - it doesn't affect any version of package firefox  (opens in a new tab)

Threat Intelligence

EPSS
0.49% (41st percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-RHEL9-FIREFOX-10631801
  • published5 Jul 2025
  • disclosed1 Oct 2024
Report a new vulnerability Found a mistake?

Introduced: 1 Oct 2024

CVE-2024-9394  (opens in a new tab)
CWE-94  (opens in a new tab)

Amendment

The Red Hat security team deemed this advisory irrelevant for RHEL:9.

NVD Description

Note: Versions mentioned in the description apply only to the upstream firefox package and not the firefox package as distributed by RHEL.

An attacker could, via a specially crafted multipart response, execute arbitrary JavaScript under the resource://devtools origin. This could allow them to access cross-origin JSON content. This access is limited to "same site" documents by the Site Isolation feature on desktop clients, but full cross-origin access is possible on Android versions. This vulnerability affects Firefox < 131, Firefox ESR < 128.3, Firefox ESR < 115.16, Thunderbird < 128.3, and Thunderbird < 131.