CVE-2024-10464

What it actually does

Repeated writes to history interface attributes can trigger a Denial of Service condition in the browser; mitigated by adding rate-limiting to the API.

Why it matters to the business

Browser unavailability can interrupt user workflows and operations across environments with 21 downstream dependents; espionage and financially motivated actors have targeted similar issues, requiring urgent attention despite low EPSS.

How an attack unfolds

An attacker serves a malicious webpage that performs repeated writes to history interface attributes, exhausting resources and causing browser DoS; this technique appears in 2024 Zero-Day Exploitation Campaigns by Espionage and Financially Motivated Actors and Mozilla Firefox Use-After-Free Vulnerability campaigns.

How to fix it

Upgrade affected Firefox to version 132 or later, Firefox ESR to 128.4 or later, Thunderbird to 128.4 or later; for listed protobuf packages apply exact fixes including protobuf (Ubuntu:Pro:16.04:LTS) to 2.6.1-1.3ubuntu0.1~esm2, protobuf (Ubuntu:20.04:LTS) to 3.6.1.3-2ubuntu5, and protobuf (Ubuntu:22.04:LTS) to 3.12.4-1ubuntu5.

How to confirm the fix worked

Confirm browser and package versions match or exceed the fixed releases; test that rate-limiting prevents repeated history attribute writes from causing unresponsiveness.

Typical attack path

1. Host a webpage containing JavaScript that repeatedly modifies history interface attributes
2. Lure victim into visiting the page with a vulnerable browser
3. Trigger sustained writes to exhaust browser resources
4. Browser enters unresponsive DoS state

How to detect it

Review web server and browser logs for repeated history API calls from untrusted origins; correlate with known threat actor patterns from 2024 campaigns; check for sudden browser crashes or high resource usage without other causes.

What your security team should do

• Prioritize patching Firefox, ESR, and Thunderbird instances within CISA-relevant timeframes given actor interest
• Update all listed protobuf packages to the exact fixed versions provided
• Monitor EPSS trend and threat actor reports for changes in exploit maturity
• Audit web-facing applications for exposure to history API abuse