Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.1

Firefox and Thunderbird: Malicious Extensions Can Tamper with Web Traffic

CVE-2024-7525 · published 2 years ago
Summary

A security issue in older versions of Firefox and Thunderbird allows extensions with limited permissions to read and modify web pages. This could potentially allow malicious extensions to steal sensitive information or inject malware. Update to the latest version to fix this issue.

What to do
  • Update mozilla firefox to version 129.0 or later.
  • Update mozilla firefox_esr to version 115.14.0 or later.
  • Update mozilla thunderbird to version 115.14.0 or later.
Affected software
VendorProductAffected versions
mozilla firefox < 129.0
cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*
mozilla firefox_esr < 115.14.0
128.0
cpe:2.3:a:mozilla:firefox_esr:*:*:*:*:*:*:*:*
mozilla thunderbird < 115.14.0
128.0.1
cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*
Original advisory text
It was possible for a web extension with minimal permissions to create a `StreamFilter` which could be used to read and modify the response body of requests on any site. This vulnerability affects ...
It was possible for a web extension with minimal permissions to create a `StreamFilter` which could be used to read and modify the response body of requests on any site. This vulnerability affects Firefox < 129, Firefox ESR < 115.14, Firefox ESR < 128.1, Thunderbird < 128.1, and Thunderbird < 115.14.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker partial control
Severity
8.1 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-276Incorrect Default Permissions
CWE-284Improper Access Control
Timeline
Published6 Aug 2024
Updated4 Nov 2026
First seen7 Mar 2026
Sources
CVE-2024-7525 · NVD
Track software like this
Free during beta