CVE-2024-2610: Mozilla Firefox XSS Vulnerability

CVE-2024-2610 Overview

CVE-2024-2610 is a markup injection vulnerability affecting Mozilla Firefox, Firefox Extended Support Release (ESR), and Thunderbird. Attackers could exploit the flaw to steal Content Security Policy (CSP) nonce values from rendered pages. Once obtained, these nonce values allow adversaries to bypass strict CSP directives that would otherwise block untrusted script execution. The issue is categorized under [CWE-94] (Improper Control of Generation of Code).

Mozilla addressed the vulnerability across three concurrent advisories covering Firefox 124, Firefox ESR 115.9, and Thunderbird 115.9. Exploitation requires user interaction with a malicious page, and the impact is limited to confidentiality and integrity of web content boundaries.

Critical Impact
Successful exploitation lets an attacker bypass strict CSP protections, enabling script execution paths that developers explicitly attempted to block through nonce-based allowlists.

Affected Products

Mozilla Firefox versions prior to 124
Mozilla Firefox ESR versions prior to 115.9
Mozilla Thunderbird versions prior to 115.9

Discovery Timeline

2024-03-19 - CVE-2024-2610 published to the National Vulnerability Database (NVD)
2024-03-22 - Debian LTS security announcement issued for affected packages
2024-03-28 - Second Debian LTS security announcement issued
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-2610

Vulnerability Analysis

The vulnerability resides in how the browser engine processes markup that interacts with CSP-protected content. Modern web applications use nonce-based CSP directives to allow only inline scripts carrying a server-generated, unpredictable nonce attribute. Because these values are meant to remain hidden from untrusted script contexts, any leakage undermines the entire CSP model.

Attackers craft markup that manipulates the parser into exposing attribute values, including the nonce attribute, back to attacker-controlled code paths. Once the nonce is captured, an attacker can inject additional <script> elements carrying the stolen nonce and execute code that the CSP was designed to prevent. The vulnerability spans both Firefox's Gecko rendering engine and Thunderbird's HTML mail rendering pipeline.

Root Cause

The root cause is improper handling of markup that allows attribute values protected by CSP semantics to be reflected or observable through side channels in the DOM. The fix enforces stricter parser behavior so nonce attributes are stripped or hidden from any content that could re-emit them.

Attack Vector

An attacker hosts a page that combines a CSP-protected target context with markup injection primitives, typically leveraging an existing HTML injection sink on the victim site. The victim must load the malicious content, which qualifies as the required user interaction. After the browser processes the crafted markup, the attacker recovers the active nonce, then delivers a follow-up payload that satisfies the CSP allowlist and runs script in the origin's context.

No verified proof-of-concept code has been published. Refer to the Mozilla Bug Report #1871112 and Mozilla Security Advisory MFSA-2024-12 for the vendor's technical description.

Detection Methods for CVE-2024-2610

Indicators of Compromise

Client browser versions reporting user-agent strings for Firefox below 124, Firefox ESR below 115.9, or Thunderbird below 115.9 in enterprise telemetry.
Web server logs showing script sources loaded with nonce values that do not match server-issued values for the current session.
CSP violation reports absent for pages where inline script execution occurred, suggesting nonce reuse rather than a bypass attempt.

Detection Strategies

Enable CSP report-to and report-uri endpoints and centralize collection to detect anomalous nonce usage patterns.
Correlate outbound HTTP requests from browsers to domains recently associated with markup injection campaigns targeting Mozilla products.
Inventory endpoint software versions and flag hosts still running Firefox, Firefox ESR, or Thunderbird below the fixed releases.

Monitoring Recommendations

Track CSP violation report volumes for spikes that could indicate probing against nonce-protected pages.
Monitor email gateways for HTML mail content that abuses markup constructs, given Thunderbird's exposure through message rendering.
Alert on browser processes loading content from newly registered or low-reputation domains on unpatched hosts.

How to Mitigate CVE-2024-2610

Immediate Actions Required

Upgrade Firefox to version 124 or later on all managed endpoints.
Upgrade Firefox ESR to 115.9 or later where the extended support channel is deployed.
Upgrade Thunderbird to 115.9 or later, prioritizing systems that render HTML mail from external senders.
Apply distribution-specific updates such as those referenced in the Debian LTS Security Announcement for Linux fleets.

Patch Information

Mozilla shipped fixes in Firefox 124, Firefox ESR 115.9, and Thunderbird 115.9. Full details are documented in Mozilla Security Advisory MFSA-2024-12, Mozilla Security Advisory MFSA-2024-13, and Mozilla Security Advisory MFSA-2024-14.

Workarounds

Configure Thunderbird to display messages as plain text where operationally acceptable, reducing exposure to HTML markup injection.
Restrict browser access to untrusted sites through enterprise proxy policy until patches are deployed.
Deploy strict CSP directives that combine nonces with strict-dynamic and hash-based allowlists so a stolen nonce alone is less useful.

bash

# Configuration example: enforce a strict CSP with reporting
Content-Security-Policy: default-src 'self'; \
  script-src 'nonce-{{server-generated}}' 'strict-dynamic'; \
  object-src 'none'; \
  base-uri 'none'; \
  report-to csp-endpoint