CVE-2024-1554: Mozilla Firefox

Critical severity, CVSS 9.8. EPSS: 0.4% chance of exploitation in the next 30 days.

The `fetch()` API and navigation incorrectly shared the same cache, as the cache key did not include the optional headers `fetch()` may contain. Under the correct circumstances, an attacker may have been able to poison the local browser cache by priming it with a `fetch()` response controlled by the additional headers. Upon navigation to the same URL, the user would see the cached response instead of the expected response. This vulnerability affects Firefox < 123.

Affected products

• Mozilla Firefox: before 123.0 (fixed in 123.0)

Published 2024-02-20. Last modified 2026-06-17.