CVE-2024-29944: Mozilla Firefox RCE Vulnerability

CVE-2024-29944 Overview

CVE-2024-29944 is a high-severity vulnerability in Mozilla Firefox Desktop that allows attackers to inject an event handler into a privileged object. Successful exploitation results in arbitrary JavaScript execution in the parent process, escaping the browser's content sandbox. The flaw affects Firefox versions prior to 124.0.1 and Firefox ESR versions prior to 115.9.1. Mobile Firefox is not affected. Mozilla addressed the issue in security advisories MFSA-2024-15 and MFSA-2024-16. The CWE classification is [CWE-830] (Inclusion of Web Functionality from an Untrusted Source). Debian also issued a Long Term Support advisory for affected debian_linux package builds.

Critical Impact
Arbitrary JavaScript execution in the privileged Firefox parent process enables sandbox escape, granting attackers the ability to run code outside the browser's content security boundary.

Affected Products

Mozilla Firefox Desktop versions prior to 124.0.1
Mozilla Firefox ESR versions prior to 115.9.1
Debian Linux 10.0 (Firefox package, addressed via Debian LTS advisory)

Discovery Timeline

2024-03-22 - CVE-2024-29944 published to the National Vulnerability Database
2025-04-01 - Last updated in NVD database

Technical Details for CVE-2024-29944

Vulnerability Analysis

The vulnerability resides in Firefox's handling of privileged objects exposed to content. An attacker who can influence a privileged object's properties can attach an event handler that executes JavaScript inside the parent process context. Firefox's multi-process architecture separates untrusted content (child processes) from the privileged parent process that manages chrome UI, network I/O, and operating system access. Code execution in the parent process bypasses the content sandbox entirely.

The issue is classified under [CWE-830] (Inclusion of Web Functionality from an Untrusted Source), indicating that untrusted content was treated as trusted by a privileged component. Exploitation grants the attacker the same privileges as the browser process itself.

Root Cause

The root cause is improper isolation between content-supplied data and privileged objects exposed in the parent process. The privileged object accepted an event handler assignment originating from less-trusted content, allowing attacker-controlled JavaScript to execute with chrome-level privileges. Mozilla's advisories MFSA-2024-15 and MFSA-2024-16 describe the fix.

Attack Vector

The CVSS vector indicates a local attack vector with no privileges or user interaction required. In practical terms, exploitation typically occurs through interaction with a malicious page or local content that triggers the vulnerable code path. Once the event handler executes in the parent process, the attacker can perform actions outside the content sandbox, including file system access and process spawning, subject to operating system permissions.

No public proof-of-concept is currently catalogued, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Technical details are referenced in the Mozilla Bugzilla Report #1886852.

Detection Methods for CVE-2024-29944

Indicators of Compromise

Firefox parent process (firefox.exe or firefox) spawning unexpected child processes such as command shells, scripting interpreters, or cmd.exe
Unexpected file system writes performed by the Firefox parent process outside its standard profile directories
Outbound network connections originating from the Firefox parent process to unfamiliar hosts following web navigation

Detection Strategies

Inventory installed Firefox versions across endpoints and flag any installation below 124.0.1 (Desktop) or 115.9.1 (ESR)
Monitor for anomalous process lineage where Firefox is the parent of OS-level interpreters or shells
Correlate browser process behavior with file integrity monitoring on user profile and system directories

Monitoring Recommendations

Centralize browser version telemetry in the security data lake to identify unpatched hosts at scale
Enable EDR behavioral monitoring on browser processes for sandbox-escape patterns such as parent-process code injection or privileged API calls
Track Mozilla security advisories MFSA-2024-15 and MFSA-2024-16 for any updated guidance

How to Mitigate CVE-2024-29944

Immediate Actions Required

Update Firefox Desktop to version 124.0.1 or later and Firefox ESR to 115.9.1 or later on all endpoints
Apply the Debian LTS update referenced in the Debian LTS Advisory Announcement for affected Debian systems
Verify enterprise deployments via Group Policy or configuration management to confirm the patched version is enforced

Patch Information

Mozilla released fixes in Firefox 124.0.1 and Firefox ESR 115.9.1. Refer to the Mozilla Security Advisory MFSA-2024-15 and Mozilla Security Advisory MFSA-2024-16 for vendor guidance. The Openwall OSS-Security Discussion provides additional community context.

Workarounds

No vendor-supplied workaround exists; upgrading to a patched build is the only supported remediation
Restrict browsing to trusted sites and disable execution of untrusted local HTML content until patches are deployed
Apply application allowlisting to prevent the Firefox parent process from spawning unexpected child executables

bash

# Verify installed Firefox version on Linux endpoints
firefox --version

# Debian / Ubuntu: apply vendor updates
sudo apt update && sudo apt install --only-upgrade firefox-esr

# Windows: confirm patched version via registry
reg query "HKLM\SOFTWARE\Mozilla\Mozilla Firefox" /v CurrentVersion