Skip to content
fr Sign in
7.5 High

CVE-2024-8383 Firefox normally asks for confirmation before asking the operating system to find an application to handle a scheme that…

Description

Firefox normally asks for confirmation before asking the operating system to find an application to handle a scheme that the browser does not support. It did not ask before doing so for the Usenet-related schemes news: and snews:. Since most operating systems don't have a trusted newsreader installed by default, an unscrupulous program that the user downloaded could register itself as a handler. The website that served the application download could then launch that application at will. This vulnerability affects Firefox < 130, Firefox ESR < 128.2, and Firefox ESR < 115.15.

Affected products and versions

Product Affected versions Fixed in
Firefox 130 earliest → < 130 130
Firefox ESR 115.15 earliest → < 115.15 115.15
firefox_esr 128.2 earliest → < 128.2 128.2
firefox_esr 115.15 earliest → < 115.15 115.15

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Firefox

The 2221 CVEs of Firefox →
CVE-2026-120572 Incorrect boundary conditions in the Layout: Block and Inline component 8.8 High CVE-2026-118027 Frame poisoning in the Layout component 9.1 Critical CVE-2026-118026 Invalid pointer in the JavaScript: GC component 8.8 High CVE-2026-118025 Other issue in the SVG component 8.8 High
Track this CVE