CVE-2024-6611: Mozilla Firefox XSS Vulnerability

CVE-2024-6611 Overview

CVE-2024-6611 is a SameSite cookie enforcement flaw affecting Mozilla Firefox and Thunderbird versions prior to 128. A nested iframe that triggers a cross-site navigation can cause the browser to transmit cookies marked SameSite=Strict or SameSite=Lax in contexts where the SameSite policy should block them. This weakens a core defense against cross-site request forgery (CSRF) and cross-site information leakage. The issue is classified under CWE-1275, Sensitive Cookie with Improper SameSite Attribute.

Critical Impact
Attackers controlling a malicious site can leverage nested iframes to coerce victim browsers into sending session cookies cross-site, enabling CSRF and authenticated request forgery against vulnerable web applications.

Affected Products

Mozilla Firefox versions prior to 128
Mozilla Thunderbird versions prior to 128
All platforms supported by the affected Mozilla builds

Discovery Timeline

2024-07-09 - CVE-2024-6611 published to the National Vulnerability Database
2025-04-04 - Last updated in NVD database

Technical Details for CVE-2024-6611

Vulnerability Analysis

The SameSite cookie attribute restricts when browsers attach cookies to cross-site requests. SameSite=Strict should suppress the cookie on any cross-site navigation, while SameSite=Lax permits cookies only on top-level navigations using safe HTTP methods. CVE-2024-6611 breaks this contract when a navigation is triggered from within a nested iframe context.

The browser misclassifies the navigation initiator and treats the request as same-site eligible. As a result, cookies that should be withheld are transmitted to the destination origin. The EPSS score is 0.59% at the 69th percentile, indicating moderate exploit-likelihood signal for this class of flaw.

Mozilla addressed the issue in advisories MFSA-2024-29 and MFSA-2024-32, shipped in Firefox 128 and Thunderbird 128.

Root Cause

The root cause is improper enforcement of the SameSite policy during navigations originating from nested browsing contexts. The cookie-attachment logic does not correctly walk the frame ancestry to determine the true cross-site relationship between the initiator and the destination. This is a logic flaw in cookie scoping rather than a memory safety issue.

Attack Vector

Exploitation requires an attacker-controlled web page that a victim visits while authenticated to a target site. The attacker embeds a nested iframe structure and triggers a cross-site navigation from within the inner frame. The browser then sends SameSite=Lax or SameSite=Strict cookies to the target origin, attaching the victim's authenticated session to the attacker-initiated request. This enables CSRF against applications that relied on SameSite as their primary cross-origin defense.

No verified public proof-of-concept code is associated with this CVE. Refer to the Mozilla Bug Report #1844827 for technical discussion.

Detection Methods for CVE-2024-6611

Indicators of Compromise

Outbound HTTP requests from Firefox or Thunderbird builds older than 128 carrying authenticated session cookies to origins different from the user's active tab origin.
Server-side access logs showing state-changing POST requests with valid session cookies but Referer or Origin headers pointing to unrelated third-party domains.
Anomalous form submissions or API calls originating from iframe contexts on untrusted sites.

Detection Strategies

Inventory endpoints running Firefox or Thunderbird and flag any version below 128 for remediation tracking.
Inspect web application logs for CSRF-indicative patterns such as unexpected cross-origin referrers paired with authenticated cookies.
Correlate browser version telemetry from endpoint agents with web proxy logs to identify users still exposed to the flaw.

Monitoring Recommendations

Monitor proxy and web gateway logs for navigation chains involving nested iframes followed by sensitive POST traffic.
Track Mozilla product version distribution across the fleet and alert when outdated browsers connect to corporate web applications.
Enable detailed CSRF telemetry on internal applications, including logging of Sec-Fetch-Site and Origin headers.

How to Mitigate CVE-2024-6611

Immediate Actions Required

Upgrade Firefox to version 128 or later on all managed endpoints.
Upgrade Thunderbird to version 128 or later on all systems with the client installed.
Audit internal and external web applications to confirm CSRF defenses do not rely solely on SameSite cookies.
Force-close and relaunch browser sessions after deploying the update to ensure the patched binary is active.

Patch Information

Mozilla released fixes in Firefox 128 and Thunderbird 128. Apply the updates documented in Mozilla Security Advisory MFSA-2024-29 and Mozilla Security Advisory MFSA-2024-32. Enterprise administrators should distribute the patched builds through their standard software management tooling and verify version compliance.

Workarounds

Implement CSRF tokens on all state-changing endpoints rather than depending on SameSite cookie enforcement alone.
Set the Sec-Fetch-Site header check on the server side to reject requests with cross-site values on sensitive routes.
Restrict embedding of authenticated applications using a strict Content-Security-Policyframe-ancestors directive.
Use short-lived session tokens and require re-authentication for high-impact actions until all endpoints are patched.

bash

# Example server-side header check (nginx)
map $http_sec_fetch_site $csrf_block {
    default                 0;
    "cross-site"            1;
}

server {
    location /api/ {
        if ($csrf_block) { return 403; }
        proxy_pass http://backend;
    }
}