CVE-2024-26283

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-26283
An attacker could have executed unauthorized scripts on top origin sites using a JavaScript URI when opening an external URL with a custom Firefox scheme. This vulnerability affects Firefox for iOS < 123.

7.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://bugzilla.mozilla.org/show_bug.cgi?id=1850158 Issue Tracking
https://www.mozilla.org/security/advisories/mfsa2024-08/ Vendor Advisory
https://bugzilla.mozilla.org/show_bug.cgi?id=1850158 Issue Tracking
https://www.mozilla.org/security/advisories/mfsa2024-08/ Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:mozilla:firefox:*:*:*:*:*:iphone_os:*:*
History

27 Mar 2025, 14:46

Type Values Removed Values Added
CPE cpe:2.3:a:mozilla:firefox:*:*:*:*:*:iphone_os:*:*
References () https://bugzilla.mozilla.org/show_bug.cgi?id=1850158 - () https://bugzilla.mozilla.org/show_bug.cgi?id=1850158 - Issue Tracking
References () https://www.mozilla.org/security/advisories/mfsa2024-08/ - () https://www.mozilla.org/security/advisories/mfsa2024-08/ - Vendor Advisory
First Time Mozilla
Mozilla firefox

21 Nov 2024, 09:02

Type Values Removed Values Added
References () https://bugzilla.mozilla.org/show_bug.cgi?id=1850158 - () https://bugzilla.mozilla.org/show_bug.cgi?id=1850158 -
References () https://www.mozilla.org/security/advisories/mfsa2024-08/ - () https://www.mozilla.org/security/advisories/mfsa2024-08/ -

29 Aug 2024, 20:36

Type Values Removed Values Added
Summary
  • (es) Un atacante podría haber ejecutado scripts no autorizados en los principales sitios de origen utilizando un URI de JavaScript al abrir una URL externa con un esquema personalizado de Firefox. Esta vulnerabilidad afecta a Firefox para iOS &lt; 123.
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.8
CWE CWE-83

22 Feb 2024, 15:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-02-22 15:15

Updated : 2025-03-27 14:46

NVD link : CVE-2024-26283

Mitre link : CVE-2024-26283

CVE.ORG link : CVE-2024-26283

JSON object : View

Products Affected

mozilla

  • firefox
CWE
CWE-83

Improper Neutralization of Script in Attributes in a Web Page