CVE-2024-11700

Severity: high (CVSS 8.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-11-26 · updated 2026-06-17
Weakness: CWE-1021

Description

Malicious websites may have been able to perform user intent confirmation through tapjacking. This could have led to users unknowingly approving the launch of external applications, potentially exposing them to underlying vulnerabilities. This vulnerability affects Firefox < 133 and Thunderbird < 133.

Affected products

Mozilla Firefox: before 133.0 — fixed in 133.0
Mozilla Thunderbird: before 133.0 — fixed in 133.0

How to fix

Upgrade to a fixed version: Mozilla Firefox 133.0; Mozilla Thunderbird 133.0. Check the vendor advisory for mitigations.

References

https://bugzilla.mozilla.org/show_bug.cgi?id=1836921
https://www.mozilla.org/security/advisories/mfsa2024-63/
https://www.mozilla.org/security/advisories/mfsa2024-67/

Get alerted when CVE-2024-11700 or the next vulnerability affects your stack