CVE-2024-11694: Mozilla Firefox DOM-based XSS Vulnerability

CVE-2024-11694 Overview

CVE-2024-11694 is a Cross-Site Scripting (XSS) vulnerability affecting Mozilla Firefox and Thunderbird products. Enhanced Tracking Protection's Strict mode may have inadvertently allowed a Content Security Policy (CSP) frame-src bypass and DOM-based XSS through the Google SafeFrame shim in the Web Compatibility extension. This issue could have exposed users to malicious frames masquerading as legitimate content, potentially allowing attackers to inject and execute malicious scripts in the context of the affected browser or email client.

Critical Impact
Users with Enhanced Tracking Protection in Strict mode could be vulnerable to DOM-based XSS attacks through the Google SafeFrame shim, allowing malicious actors to bypass CSP protections and potentially steal sensitive information or perform actions on behalf of the user.

Affected Products

Mozilla Firefox < 133
Mozilla Firefox ESR < 128.5 and < 115.18
Mozilla Thunderbird < 133, < 128.5, and < 115.18

Discovery Timeline

2024-11-26 - CVE-2024-11694 published to NVD
2025-11-03 - Last updated in NVD database

Technical Details for CVE-2024-11694

Vulnerability Analysis

This vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), commonly known as Cross-Site Scripting (XSS). The flaw exists within the Web Compatibility extension's implementation of the Google SafeFrame shim, which is designed to provide a secure container for serving advertisements. When Enhanced Tracking Protection is set to Strict mode, the extension's SafeFrame implementation fails to properly enforce CSP frame-src directives, creating an unintended pathway for DOM-based XSS attacks.

The vulnerability requires user interaction to exploit, as victims must visit a malicious webpage or receive crafted content that leverages this bypass. Once exploited, attackers can execute arbitrary JavaScript within the security context of the affected application, potentially leading to session hijacking, credential theft, or manipulation of displayed content.

Root Cause

The root cause stems from improper handling of frame sources within the Google SafeFrame shim component of the Web Compatibility extension. When Enhanced Tracking Protection operates in Strict mode, the extension's logic for managing SafeFrame content inadvertently creates an exception that allows frames from untrusted sources to bypass the CSP frame-src directive. This occurs because the shim does not properly validate or sanitize frame origins before rendering content, leading to a DOM-based XSS condition where malicious scripts can be injected and executed.

Attack Vector

The attack vector is network-based and requires user interaction. An attacker can exploit this vulnerability by crafting a malicious webpage that leverages the SafeFrame shim bypass. When a user with Enhanced Tracking Protection in Strict mode visits the attacker-controlled page, the malicious content can bypass CSP restrictions and execute arbitrary JavaScript within the browser context.

The attack flow involves:

Attacker creates a webpage containing a specially crafted frame that exploits the SafeFrame shim
Victim with Enhanced Tracking Protection in Strict mode visits the malicious page
The malicious frame bypasses CSP frame-src restrictions through the vulnerability
DOM-based XSS payload executes in the context of the victim's browser session
Attacker can steal session tokens, redirect users, or perform other malicious actions

Due to the DOM-based nature of this XSS vulnerability, the malicious payload is processed entirely on the client side, making server-side filtering ineffective. The vulnerability affects both browsing sessions in Firefox and email rendering in Thunderbird, expanding the potential attack surface.

Detection Methods for CVE-2024-11694

Indicators of Compromise

Unexpected iframe elements appearing on webpages that should be blocked by CSP policies
Browser console errors indicating CSP violations followed by successful frame loading
Unusual JavaScript execution originating from third-party frame sources
Network traffic to suspicious domains embedded within SafeFrame containers

Detection Strategies

Monitor browser extension behavior for anomalous frame loading patterns that bypass configured CSP directives
Implement Content Security Policy reporting (report-uri or report-to directives) to capture and analyze CSP violation attempts
Deploy endpoint detection solutions capable of identifying DOM manipulation attempts and suspicious script execution
Analyze web traffic logs for patterns consistent with XSS payload delivery through frame injection

Monitoring Recommendations

Enable CSP violation reporting to a centralized logging system for analysis of bypass attempts
Configure SIEM rules to alert on patterns of frame-based content injection followed by unexpected script execution
Monitor for browser versions that fall within the vulnerable range (Firefox < 133, Firefox ESR < 128.5/115.18, Thunderbird < 133/128.5/115.18)
Implement browser telemetry collection to identify potential exploitation attempts across the organization

How to Mitigate CVE-2024-11694

Immediate Actions Required

Update Mozilla Firefox to version 133 or later immediately
Update Mozilla Firefox ESR to version 128.5 or 115.18 or later
Update Mozilla Thunderbird to version 133, 128.5, or 115.18 or later
Review Enhanced Tracking Protection settings and consider temporarily switching to Standard mode until patches are applied
Audit systems for vulnerable browser versions using software inventory tools

Patch Information

Mozilla has released security patches addressing this vulnerability across multiple product lines. Organizations should apply the following updates as documented in the official Mozilla Security Advisories:

Mozilla Security Advisory MFSA-2024-63 - Firefox 133
Mozilla Security Advisory MFSA-2024-64 - Firefox ESR 128.5
Mozilla Security Advisory MFSA-2024-65 - Firefox ESR 115.18
Mozilla Security Advisory MFSA-2024-67 - Thunderbird 133
Mozilla Security Advisory MFSA-2024-68 - Thunderbird 128.5
Mozilla Security Advisory MFSA-2024-70 - Thunderbird 115.18

For technical details on the underlying bug, refer to Mozilla Bug Report #1924167. Debian users should also review the Debian LTS Announcement for distribution-specific guidance.

Workarounds

Temporarily disable the Web Compatibility extension if the feature is not critical to operations
Switch Enhanced Tracking Protection from Strict mode to Standard mode until patches can be applied
Implement additional CSP headers at the web application level to provide defense-in-depth
Use browser isolation or containerization technologies to limit the impact of potential exploitation
Consider using browser security extensions that provide additional XSS protection mechanisms

bash

# Check Firefox version from command line
firefox --version

# Check Thunderbird version from command line
thunderbird --version

# For enterprise deployments, use policies.json to enforce updates
# Location: /distribution/policies.json (Linux) or installation directory (Windows)
# Example policy to disable Web Compatibility extension temporarily:
# {
#   "policies": {
#     "Extensions": {
#       "Locked": ["webcompat@mozilla.org"]
#     }
#   }
# }