CVE-2024-9398: Mozilla Firefox Information Disclosure Flaw

CVE-2024-9398 Overview

CVE-2024-9398 is an information disclosure vulnerability affecting Mozilla Firefox, Firefox Extended Support Release (ESR), and Thunderbird. Attackers can determine whether specific applications are installed on a target system by invoking window.open with custom protocol handlers and inspecting the return value. The flaw enables client-side fingerprinting of installed software without user interaction. Mozilla addressed the issue in Firefox 131, Firefox ESR 128.3, Thunderbird 128.3, and Thunderbird 131. The weakness is categorized under [CWE-203] (Observable Discrepancy).

Critical Impact
Remote web content can enumerate installed protocol-handling applications, enabling browser and user fingerprinting that supports targeted phishing and reconnaissance.

Affected Products

Mozilla Firefox versions prior to 131
Mozilla Firefox ESR versions prior to 128.3
Mozilla Thunderbird versions prior to 128.3 and prior to 131

Discovery Timeline

2024-10-01 - CVE-2024-9398 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-9398

Vulnerability Analysis

The vulnerability resides in how Firefox and Thunderbird surface the outcome of window.open calls that target registered external protocol handlers. When a web page calls window.open with a URI scheme such as ms-word: or slack:, the browser's behavior differs depending on whether a handler is registered for that scheme. An attacker-controlled script can observe the returned window reference, timing, or error state and infer the presence of the corresponding desktop application.

This observable discrepancy transforms a routine browser feature into a fingerprinting primitive. While the vulnerability does not directly compromise confidentiality of user data, it exposes environmental metadata that attackers combine with other signals to profile victims. The affected product family shares the Gecko engine, which explains the parallel exposure in Firefox, Firefox ESR, and Thunderbird.

Root Cause

The root cause is an information leak through the protocol handler dispatch path. The browser fails to normalize behavior between installed and uninstalled handlers, allowing scripts to distinguish between the two states. This falls under [CWE-203], where different code paths produce measurably different responses to attacker-controlled input.

Attack Vector

Exploitation requires only that the victim visit a malicious or compromised web page. No authentication, elevated privileges, or user interaction is required. The attacker's script iterates through a candidate list of protocol schemes and records which invocations succeed. Refer to Mozilla Bug Report #1881037 for the underlying technical discussion.

No verified public exploit code is available. The vulnerability manifests entirely in client-side JavaScript that inspects the return value of window.open calls issued against non-HTTP protocol schemes.

Detection Methods for CVE-2024-9398

Indicators of Compromise

Web pages issuing rapid sequential window.open calls to non-HTTP protocol schemes such as ms-word:, slack:, zoommtg:, or tg:
Outbound requests to reconnaissance endpoints correlated with browser version strings from Firefox versions prior to 131 or Thunderbird versions prior to 128.3
Unusual referrer patterns where landing pages precede targeted phishing lures that reference software the victim actually has installed

Detection Strategies

Monitor browser telemetry and endpoint proxy logs for JavaScript patterns invoking many protocol handlers in short succession from a single page load
Inventory Firefox, Firefox ESR, and Thunderbird versions across the fleet and flag hosts running versions below the patched builds
Correlate phishing incidents with visits to unfamiliar sites that immediately preceded targeted lures referencing specific installed applications

Monitoring Recommendations

Track Mozilla product versions through endpoint management tools and generate alerts when unpatched instances communicate with untrusted domains
Review web gateway logs for JavaScript payloads that enumerate custom URI schemes
Enable browser update reporting to confirm that ESR and rapid-release channels reach the fixed versions across all user segments

How to Mitigate CVE-2024-9398

Immediate Actions Required

Update Firefox to version 131 or later, Firefox ESR to 128.3 or later, and Thunderbird to 128.3 or 131 as appropriate for your deployment channel
Enforce automatic browser updates through group policy or endpoint management to eliminate lag on ESR channels
Audit installed protocol handlers on managed endpoints and remove handlers that are not required for business operations

Patch Information

Mozilla addressed the issue in the security releases documented in Mozilla Security Advisory MFSA-2024-46, MFSA-2024-47, MFSA-2024-49, and MFSA-2024-50. Administrators managing enterprise deployments should validate that policy templates target the fixed version strings.

Workarounds

Restrict script execution on untrusted origins using enterprise policy controls such as javascript.enabled scoping or Content Security Policy enforcement at the web gateway
Deploy browser extensions or gateway rules that block or prompt on external protocol handler invocations from third-party origins
Segment users who cannot patch immediately into a network zone with stricter web filtering until the update reaches all endpoints

bash

# Example: enforce Firefox auto-update via enterprise policy (policies.json)
{
  "policies": {
    "DisableAppUpdate": false,
    "AppAutoUpdate": true,
    "OverrideFirstRunPage": "",
    "BlockAboutConfig": true
  }
}