CVE-2024-9394: Mozilla Firefox XSS Vulnerability

CVE-2024-9394 Overview

CVE-2024-9394 is a high-severity vulnerability affecting Mozilla Firefox, Firefox ESR, and Thunderbird. An attacker can deliver a specially crafted multipart HTTP response to execute arbitrary JavaScript under the privileged resource://devtools origin. Successful exploitation enables cross-origin access to JSON content served by other sites.

Desktop builds limit the impact to same-site documents through the Site Isolation feature. Android builds of Firefox lack this constraint and permit full cross-origin access, increasing the data exposure risk on mobile platforms. The flaw is tracked under [CWE-79] (Cross-Site Scripting).

Critical Impact
Remote attackers can read cross-origin JSON content from a victim's browser session by serving a malicious multipart response, with no user interaction beyond visiting a page.

Affected Products

Mozilla Firefox versions earlier than 131
Mozilla Firefox ESR versions earlier than 128.3 and earlier than 115.16
Mozilla Thunderbird versions earlier than 128.3 and earlier than 131

Discovery Timeline

2024-10-01 - CVE-2024-9394 published to NVD
2025-11-03 - Last updated in NVD database

Technical Details for CVE-2024-9394

Vulnerability Analysis

The vulnerability resides in how Firefox and Thunderbird handle multipart/x-mixed-replace responses inside developer tools contexts. When the browser parses a crafted multipart response, attacker-controlled script content is evaluated under the privileged resource://devtools origin instead of the originating web origin.

Because resource:// origins carry elevated trust, JavaScript executing in that context can issue same-origin reads against other documents that the browser considers same-site. On Firefox for Android, where Site Isolation is not enforced, the boundary collapses further and any cross-origin JSON resource becomes readable.

The impact is limited to confidentiality of returned data. The attacker reads JSON payloads served to the victim, including responses gated by cookies or session credentials.

Root Cause

The root cause is improper origin assignment during multipart response handling in the devtools resource scheme. Script content embedded in a multipart part inherits the resource://devtools principal rather than the network origin, violating the same-origin policy and producing a script injection condition consistent with [CWE-79].

Attack Vector

Exploitation requires the victim to load attacker-controlled content or a page that triggers a request returning the malicious multipart response. The attacker hosts a server that responds with a multipart body containing JavaScript designed to execute under the privileged origin. Once executed, the script issues fetches for cross-origin JSON endpoints and exfiltrates the responses.

No authentication is required, attack complexity is low, and no user interaction beyond normal browsing is needed. The attack is purely network-delivered.

No verified public proof-of-concept code is available. See the Mozilla Bug Report #1918874 for additional technical context.

Detection Methods for CVE-2024-9394

Indicators of Compromise

Outbound HTTP responses with Content-Type: multipart/x-mixed-replace originating from untrusted servers and loaded by browser processes.
Browser telemetry showing script execution attributed to resource://devtools immediately following navigation to an external site.
Unexpected client-initiated requests to internal JSON APIs originating from Firefox or Thunderbird processes shortly after web browsing activity.

Detection Strategies

Inspect web proxy and TLS-decrypting gateway logs for multipart responses delivered to Firefox and Thunderbird User-Agent strings, particularly when paired with application/javascript or text/html subparts.
Correlate endpoint process telemetry for outdated Firefox, Firefox ESR, and Thunderbird versions with outbound network activity to uncategorized domains.
Use endpoint detection and response telemetry to identify Firefox or Thunderbird builds older than the patched releases listed in the affected products table.

Monitoring Recommendations

Track installed browser and mail client versions across managed endpoints and alert on versions below Firefox 131, Firefox ESR 128.3, Firefox ESR 115.16, Thunderbird 128.3, and Thunderbird 131.
Monitor for anomalous JSON exfiltration from authenticated internal web applications, especially requests issued by browser processes shortly after external navigation.
Watch Mozilla advisories MFSA-2024-46 through MFSA-2024-50 for related fixes shipped in the same release window.

How to Mitigate CVE-2024-9394

Immediate Actions Required

Update Firefox to version 131 or later on all managed desktops and mobile devices.
Update Firefox ESR to 128.3 or 115.16 on long-term-support deployments.
Update Thunderbird to 128.3 or 131 on systems used for email and calendaring.
Prioritize Android Firefox installations, where Site Isolation does not contain the impact and full cross-origin reads are possible.

Patch Information

Mozilla addressed the issue in the October 2024 release cycle. Refer to Mozilla Security Advisory MFSA-2024-46, MFSA-2024-47, MFSA-2024-48, MFSA-2024-49, and MFSA-2024-50 for the corresponding fixed releases. Debian users should apply the updates published in Debian LTS Announcement #4 and Debian LTS Announcement #6.

Workarounds

Restrict Firefox for Android usage for accessing sensitive internal web applications until devices are updated, given the absence of Site Isolation on that platform.
Enforce strict outbound web filtering to block uncategorized domains that could host crafted multipart responses.
Apply Cross-Origin-Resource-Policy: same-origin and Content-Type hardening headers on internal JSON endpoints to reduce data exposure from cross-origin reads.

bash

# Verify installed Firefox version on managed Linux endpoints
firefox --version

# Verify installed Thunderbird version
thunderbird --version

# Example Debian update command for affected packages
sudo apt-get update && sudo apt-get install --only-upgrade firefox-esr thunderbird