CVE-2024-10460: Mozilla Firefox XSS Vulnerability

CVE-2024-10460 Overview

CVE-2024-10460 is an origin spoofing vulnerability affecting Mozilla Firefox, Firefox ESR, and Thunderbird. An attacker can obscure the origin displayed in an external protocol handler prompt by embedding a data: URL inside an iframe. This misleads users about which site is requesting a protocol handoff to an external application. The flaw is classified under [CWE-346] Origin Validation Error and impacts confidentiality by facilitating social engineering attacks against the user.

Critical Impact
Attackers can disguise the true origin of external protocol handler prompts, tricking users into approving handoffs to external applications they would otherwise reject.

Affected Products

Mozilla Firefox versions prior to 132
Mozilla Firefox ESR versions prior to 128.4
Mozilla Thunderbird versions prior to 128.4 and prior to 132

Discovery Timeline

2024-10-29 - CVE-2024-10460 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-10460

Vulnerability Analysis

The vulnerability resides in how Firefox and Thunderbird render the origin string within external protocol handler prompts. When a page requests an external application handoff, the browser presents a confirmation dialog naming the requesting origin. An attacker-controlled page can embed a data: URL in a nested iframe to trigger the prompt, causing the displayed origin to reflect the opaque data: context rather than the true parent origin. The user then sees ambiguous or misleading provenance information when deciding whether to launch the external handler.

This is a user-interface trust boundary flaw. The security decision presented to the user depends on accurate origin attribution, and the prompt fails to convey it. The issue affects the browser as well as Thunderbird's rendering pipeline, which shares Gecko components.

Root Cause

The root cause is improper origin resolution when the frame issuing the external protocol request uses a data: URL. Under [CWE-346], the affected code path does not walk up to the initiating principal or otherwise normalize the visible origin. As a result, the prompt renders an origin that does not correspond to the site the user is interacting with.

Attack Vector

Exploitation requires the victim to visit an attacker-controlled or compromised web page in a vulnerable Firefox build, or to render attacker-controlled HTML content in Thunderbird. The attacker embeds an iframe sourced from a data: URL that triggers an external protocol handler. When the confirmation prompt appears, the origin field is obscured, increasing the likelihood the user approves the handoff. No authentication is required, and the attack is delivered over the network.

No public proof-of-concept exploit code has been released. Refer to the Mozilla Bug Report 1912537 for technical discussion.

Detection Methods for CVE-2024-10460

Indicators of Compromise

Outbound navigation to pages containing nested iframe elements sourced from data: URLs that immediately invoke external protocol handlers such as mailto:, tel:, ms-, or custom schemes.
Endpoint logs showing external applications launched by Firefox or Thunderbird child processes following inbound web traffic from unfamiliar domains.
Vulnerable Firefox builds below 132, Firefox ESR below 128.4, or Thunderbird below 128.4 or 132 present in software inventory.

Detection Strategies

Inventory browser and mail client versions across the fleet and flag any hosts running versions below the fixed releases.
Inspect proxy and DNS logs for pages that embed data: URI iframes triggering protocol handler prompts, particularly on domains with low reputation.
Correlate browser process telemetry with subsequent launches of external handlers to identify anomalous protocol invocations.

Monitoring Recommendations

Alert on Firefox or Thunderbird spawning child processes for uncommon URI schemes shortly after web navigation events.
Track user-reported phishing or unexpected application launches originating from web or email content.
Monitor vendor advisories from Mozilla and Linux distributions for follow-on patches, including the Debian LTS Announcement October 2024 and Debian LTS Announcement November 2024.

How to Mitigate CVE-2024-10460

Immediate Actions Required

Upgrade Firefox to version 132 or later, Firefox ESR to 128.4 or later, and Thunderbird to 128.4 or 132 or later across all endpoints.
Push updated packages to managed Linux workstations using the vendor repositories referenced in the Debian LTS advisories.
Communicate to users that external application prompts triggered by unexpected web pages should be denied.

Patch Information

Mozilla addressed the issue in Firefox 132, Firefox ESR 128.4, and Thunderbird 128.4 and 132. Full details are in Mozilla Security Advisory MFSA2024-55, MFSA2024-56, MFSA2024-58, and MFSA2024-59.

Workarounds

Restrict external protocol handler registration at the operating system level so that unexpected schemes cannot launch applications.
Deploy browser policies that disable or prompt for external protocol handlers, using enterprise policy templates for Firefox and Thunderbird.
Block untrusted data: URI navigation via web filtering where feasible, and enforce strict Content Security Policy on internally hosted applications.

bash

# Firefox enterprise policy example: disable external protocol handler auto-launch
# /etc/firefox/policies/policies.json
{
  "policies": {
    "DisabledSchemes": ["tel", "ms-appinstaller", "search-ms"],
    "BlockAboutConfig": true
  }
}