CVE-2024-7524: XSS
Firefox adds web-compatibility shims in place of some tracking scripts blocked by Enhanced Tracking Protection. On a site protected by Content Security Policy in "strict-dynamic" mode, an attacker able to inject an HTML element could have used a DOM Clobbering attack on some of the shims and achieved XSS, bypassing the CSP strict-dynamic protection.
Affected Software
Event History
Parent advisories
This vulnerability appears in the following advisories.
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2024-7524?
CVE-2024-7524 has been rated as high severity due to the potential for DOM Clobbering attacks.
How do I fix CVE-2024-7524?
To remediate CVE-2024-7524, update your Mozilla Firefox or Firefox ESR to versions 129 or 128.3.1 respectively.
Which versions of Firefox are affected by CVE-2024-7524?
CVE-2024-7524 affects Mozilla Firefox versions prior to 129.0 and Firefox ESR versions prior to 128.1.
Can CVE-2024-7524 be exploited in strict-dynamic mode?
Yes, CVE-2024-7524 can be exploited on sites using Content Security Policy in strict-dynamic mode if an attacker can inject an HTML element.
What types of attacks are associated with CVE-2024-7524?
CVE-2024-7524 is associated with DOM Clobbering attacks which can lead to unauthorized access or manipulation of web content.