CVE-2024-0751

What it actually does

A malicious devtools extension can bypass intended privilege boundaries and execute with elevated rights inside the browser process.

Why it matters to the business

Compromise of user browsers can lead to credential theft, session hijacking, or malware delivery, affecting large numbers of end-user systems across organizations that rely on these browsers.

How an attack unfolds

An attacker crafts or obtains a malicious devtools extension and tricks a user into installing it; once loaded, the extension abuses the privilege-escalation flaw to obtain higher permissions than a normal extension should have.

How to fix it

Upgrade Mozilla Firefox to version 122 or later, Firefox ESR to 115.7 or later, and Thunderbird to 115.7 or later. Remove any untrusted devtools extensions immediately.

How to confirm the fix worked

Verify installed browser versions against the fixed releases; audit installed extensions for unexpected devtools entries and confirm they are from trusted sources.

Typical attack path

1. Attacker prepares malicious devtools extension
2. Victim is socially engineered into installing the extension
3. Extension loads and exploits the devtools privilege boundary
4. Attacker gains elevated access within the browser sandbox

How to detect it

Search endpoint and browser logs for unexpected devtools extension installations or privilege-related API calls; review extension directories for unsigned or recently added items.

What your security team should do

• Apply browser and mail-client updates across all endpoints without delay
• Enforce policies that restrict installation of devtools extensions
• Monitor extension installation events in endpoint logs
• Review EPSS and threat-intel feeds periodically for any change in exploitation likelihood