CVE-2024-10460

What it actually does

An attacker can embed a data: URL in an iframe to hide the true origin of an external protocol handler prompt, allowing the prompt to appear to come from a trusted source instead of the actual malicious page.

Why it matters to the business

Users may be tricked into approving protocol handlers that launch attacker-controlled applications, increasing the chance of malware execution, credential theft, or unauthorized system access across the organization.

How an attack unfolds

An attacker hosts a malicious page containing an iframe with a data: URL that triggers an external protocol prompt. The obscured origin leads the user to believe the request is legitimate, resulting in the user approving the handler and allowing the attacker to invoke external applications or handlers.

How to fix it

Upgrade Firefox to version 132 or later, Firefox ESR to 128.4 or later, and Thunderbird to 128.4 or later (or 132 or later where applicable). Apply updates immediately across all managed endpoints and verify that auto-update mechanisms are enabled.

How to confirm the fix worked

Confirm that all instances of Firefox and Thunderbird report versions at or above the fixed releases. Test by loading a data: URL iframe in an updated browser and verify the origin is no longer obscured in the protocol prompt.

Typical attack path

1. Attacker crafts a web page with an iframe using a data: URL that invokes an external protocol handler prompt.
2. Victim visits the attacker-controlled page via phishing, compromised site, or drive-by download.
3. The prompt appears without revealing the malicious origin, leading the user to approve it.
4. The approved protocol handler executes attacker-supplied content or launches malicious external applications.

How to detect it

Review browser security and error logs for repeated or unusual external protocol handler prompts originating from data: URLs. Correlate with user reports of unexpected application launches after visiting web pages.

What your security team should do

• Deploy browser and email client updates to all endpoints within the next 48 hours.
• Disable unnecessary external protocol handlers via enterprise policy where possible.
• Monitor user reports of unexpected protocol prompts and investigate any approvals.
• Include browser version checks in endpoint compliance scans.