CVE-2024-0606: XSS

Reference Links

• https://bugzilla.mozilla.org/show_bug.cgi?id=1855030
• https://www.mozilla.org/security/advisories/mfsa2024-03/
• https://www.mozilla.org/en-US/security/advisories/mfsa2024-03/

Parent vulnerabilities

(Appears in the following advisories)

• MFSA2024-03

Peer vulnerabilities

(Found alongside the following vulnerabilities)

• CVE-2024-0605
• CVE-2024-0606

Frequently Asked Questions

• What is the severity of CVE-2024-0606?

  CVE-2024-0606 is categorized as a high-severity vulnerability due to its ability to allow unauthorized script execution.

• How do I fix CVE-2024-0606?

  To fix CVE-2024-0606, users should update their Mozilla Focus and Firefox browsers to the latest versions available.

• What type of attack does CVE-2024-0606 exploit?

  CVE-2024-0606 exploits a user experience security vulnerability through UXSS using window.open() to execute unauthorized scripts.

• Which software is affected by CVE-2024-0606?

  CVE-2024-0606 affects Mozilla Focus version 122 and prior, as well as versions of Firefox Focus on Apple iOS.

• What can attackers do with CVE-2024-0606?

  Attackers can leverage CVE-2024-0606 to execute unauthorized actions within the user's loaded webpage by opening a malicious javascript URI.