CVE-2024-9398
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk45th percentile - higher than 45% of all known CVEs
Summary
A vulnerability in Firefox and Thunderbird allows an attacker to determine if an application implementing a specific protocol handler is installed by checking the results of window.open calls with specially set protocol handlers. This affects Firefox < 131, Firefox ESR < 128.3, Thunderbird < 128.3, and Thunderbird < 131.
Risk Assessment
An attacker can remotely detect the presence of installed applications on a user's machine, aiding in target profiling and planning further attacks. This risk is particularly relevant for users of browsers and email clients in corporate environments.
Recommendation
Update Firefox to version 131 or later, Firefox ESR to 128.3 or later, and Thunderbird to 128.3 or 131 and later. Deploy updates via central management tools.
Other vulnerabilities in Firefox, Thunderbird
See all- CVE-2026-109781Medium
Denial-of-service in the Printing: Output component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
- CVE-2026-109779Medium
Race condition in the Networking: DNS component. This vulnerability was fixed in Firefox 158 and Thunderbird 158.
- CVE-2026-16408Critical
Integer overflow in the Audio/Video: Playback component in Firefox and Thunderbird. Fixed in versions 153.
- CVE-2026-16395Critical
Integer overflow in the Audio/Video component in Firefox and Thunderbird. Fixed in versions 153.
- CVE-2026-4729Critical
Memory safety bugs were found in Firefox 148 and Thunderbird 148. Some of these bugs showed evidence of memory corruption, which could potentially allow arbitrary code execution. The vulnerabilities were fixed in Firefox 149 and Thunderbird 149.
- CVE-2026-4720Critical
Memory safety bugs were found in Firefox ESR 140.8, Thunderbird ESR 140.8, Firefox 148 and Thunderbird 148. Some of these bugs showed evidence of memory corruption and could potentially be exploited to run arbitrary code with enough effort.
- CVE-2026-2807Critical
Memory safety bugs were found in Firefox 147 and Thunderbird 147. Some of these bugs showed evidence of memory corruption and could potentially be exploited to run arbitrary code. The vulnerability was fixed in Firefox 148 and Thunderbird 148.
- CVE-2026-2792Critical
Memory safety bugs were found in Firefox ESR 140.7, Firefox 147, Thunderbird ESR 140.7, and Thunderbird 147. Some of these bugs showed evidence of memory corruption and could potentially be exploited to run arbitrary code with enough effort.
- CVE-2026-74978High
Clickjacking vulnerability in the Widget component in Firefox and Thunderbird. The issue was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.
- CVE-2026-74977High
Integer overflow in the Graphics component in Firefox and Thunderbird. The issue was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.
Original NVD description (English source)
By checking the result of calls to `window.open` with specifically set protocol handlers, an attacker could determine if the application which implements that protocol handler is installed. This vulnerability affects Firefox < 131, Firefox ESR < 128.3, Thunderbird < 128.3, and Thunderbird < 131.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS