CVE-2024-11694: Mozilla Firefox

Medium severity, CVSS 6.1. EPSS: 0.5% chance of exploitation in the next 30 days.

Enhanced Tracking Protection's Strict mode may have inadvertently allowed a CSP `frame-src` bypass and DOM-based XSS through the Google SafeFrame shim in the Web Compatibility extension. This issue could have exposed users to malicious frames masquerading as legitimate content. This vulnerability affects Firefox < 133, Firefox ESR < 128.5, Firefox ESR < 115.18, Thunderbird < 133, Thunderbird < 128.5, and Thunderbird < 115.18.

Affected products

• Mozilla Firefox: before 115.8.0 (fixed in 115.8.0); before 133.0 (fixed in 133.0); from 116.0, before 128.5.0 (fixed in 128.5.0)
• Mozilla Thunderbird: before 115.18.0 (fixed in 115.18.0); from 116.0, before 128.5.0 (fixed in 128.5.0); from 129.0, before 133.0 (fixed in 133.0)

Published 2024-11-26. Last modified 2026-06-17.