CVE-2024-11701

Severity: medium (CVSS 4.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-11-26 · updated 2026-06-17
Weakness: CWE-290

Description

The incorrect domain may have been displayed in the address bar during an interrupted navigation attempt. This could have led to user confusion and possible spoofing attacks. This vulnerability affects Firefox < 133 and Thunderbird < 133.

Affected products

Mozilla Firefox: before 133.0 — fixed in 133.0
Mozilla Thunderbird: before 133.0 — fixed in 133.0

How to fix

Upgrade to a fixed version: Mozilla Firefox 133.0; Mozilla Thunderbird 133.0. Check the vendor advisory for mitigations.

References

https://bugzilla.mozilla.org/show_bug.cgi?id=1914797
https://www.mozilla.org/security/advisories/mfsa2024-63/
https://www.mozilla.org/security/advisories/mfsa2024-67/

Get alerted when CVE-2024-11701 or the next vulnerability affects your stack