Permissions, Privileges, and Access Controls in Firefox for Android - CVE-2024-11702
Published: November 26, 2024
Vulnerability identifier: #VU100962
CSH Severity: Low
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2024-11702
CWE-ID: CWE-264
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to inadequate clipboard protection in private browsing mode. When copying sensitive information, such as passwords, from private browsing tabs on Android can lead to this data be stored in the cloud-based clipboard history if enabled.
Affected software
Firefox for Android
Mozilla Thunderbird
Mozilla Thunderbird
How to mitigate CVE-2024-11702
Install updates from vendor's website.
Firefox for Android - update to 133.0
Mozilla Thunderbird - update to 133.0
Mozilla Thunderbird - update to 133.0