CVE-2024-4765: High severity Mozilla Firefox vulnerability
Web application manifests were stored by using an insecure MD5 hash which allowed for a hash collision to overwrite another application's manifest. This could have been exploited to run arbitrary code in another application's context. This issue only affects Firefox for Android. Other versions of Firefox are unaffected. This vulnerability affects Firefox < 126.
Other sources
Web application manifests were stored by using an insecure MD5 hash which allowed for a hash collision to overwrite another application's manifest. This could have been exploited to run arbitrary code in another application's context. This issue only affects Firefox for Android. Other versions of Firefox are unaffected.
— Mozilla
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Firefoxto a version that resolves this vulnerability.Fixed in 126 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 126 - Compensating control
If you need a temporary mitigation for affected Firefox for Android versions (<126) until patched, isolate or restrict which apps can read/consume Web application manifests (e.g., limit cross-app access via OS/app sandboxing and avoid exposing manifest locations to other apps).
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2024-4765?
CVE-2024-4765 is considered a high-severity vulnerability due to its potential to allow arbitrary code execution in another application's context.
How do I fix CVE-2024-4765?
To fix CVE-2024-4765, users should update Firefox for Android to version 126 or later.
What specific issue does CVE-2024-4765 address?
CVE-2024-4765 addresses the insecure use of MD5 hashing for storing web application manifests, which makes them susceptible to hash collisions.
Who is affected by CVE-2024-4765?
CVE-2024-4765 specifically affects users of Firefox for Android versions prior to 126.
Can CVE-2024-4765 lead to data breaches?
Yes, CVE-2024-4765 can potentially lead to data breaches by allowing malicious code to execute in the context of another application.