Firefox Focus
CVE-2024-0605
HIGH
Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
1DescriptionNVD
Using a javascript: URI with a setTimeout race condition, an attacker can execute unauthorized scripts on top origin sites in urlbar. This bypasses security measures, potentially leading to arbitrary code execution or unauthorized actions within the user's loaded webpage. This vulnerability affects Focus for iOS < 122.
AnalysisAI
Using a javascript: URI with a setTimeout race condition, an attacker can execute unauthorized scripts on top origin sites in urlbar. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
Technical ContextAI
This vulnerability is classified under CWE-362. Using a javascript: URI with a setTimeout race condition, an attacker can execute unauthorized scripts on top origin sites in urlbar. This bypasses security measures, potentially leading to arbitrary code execution or unauthorized actions within the user's loaded webpage. This vulnerability affects Focus for iOS < 122. Affected products include: Mozilla Firefox Focus.
RemediationAI
No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.
More in Firefox Focus
View allRemoving an XSLT parameter during processing could have lead to an exploitable use-after-free. Rated high severity (CVSS
An unexpected message in the WebGPU IPC framework could lead to a use-after-free and exploitable sandbox escape. Rated c
Utilizing a 302 redirect, an attacker could have conducted a Universal Cross-Site Scripting (UXSS) on a victim website,
Different techniques existed to obscure the fullscreen notification in Firefox and Focus for Android. Rated critical sev
An attacker could have executed unauthorized scripts on top origin sites using a JavaScript URI when opening an external
A lack of in app notification for entering fullscreen mode could have lead to a malicious website spoofing browser chrom
When recording the screen while in Private Browsing on Firefox for Android the address bar and keyboard were not hidden,
Opening links via the contextual menu in Focus iOS for certain URL schemes would fail to load but would not refresh the
Focus was incorrectly allowing internal links to utilize the app scheme used for deeplinking, which could result in link
Websites directing users to long URLs that caused eliding to occur in the location view could leverage the truncating be
Focus for iOS would not respect a Content-Disposition header of type Attachment and would incorrectly display the conten
Dragging JavaScript links to the URL bar in Focus for iOS could be utilized to run malicious scripts, potentially result
Same weakness CWE-362 – Race Condition
View allShare
External POC / Exploit Code
Leaving vuln.today