CVE-2024-11694

What it actually does

Enhanced Tracking Protection's Strict mode inadvertently permitted a CSP frame-src bypass and DOM-based XSS via the Google SafeFrame shim in the Web Compatibility extension, allowing malicious frames to masquerade as legitimate content.

Why it matters to the business

Users of affected browser versions face elevated risk of data exposure or unauthorized actions through malicious web content that bypasses intended protections, increasing potential for phishing or credential theft across the organization.

How an attack unfolds

An attacker hosts malicious content that leverages the SafeFrame shim flaw to bypass CSP restrictions, injects a DOM-based XSS payload into a frame presented as legitimate, and executes scripts in the victim's browser context to steal data or perform actions.

How to fix it

Upgrade Firefox to 133 or later, Firefox ESR to 128.5 or 115.18 or later, Thunderbird to 133 or later, Thunderbird ESR to 128.5 or 115.18 or later. Apply the listed fixed package versions for affected Wireshark installations on Ubuntu 14.04 LTS and 16.04 LTS.

How to confirm the fix worked

Verify installed browser and extension versions against the fixed releases; test CSP policies with frame-src directives and SafeFrame usage in a controlled environment to confirm bypass is no longer possible.

Typical attack path

1. Identify target users on vulnerable browser versions
2. Craft webpage exploiting SafeFrame shim to bypass CSP frame-src
3. Deliver malicious frame masquerading as trusted content
4. Trigger DOM-based XSS to execute arbitrary scripts
5. Exfiltrate session data or perform unauthorized actions

How to detect it

Review browser console logs and extension activity for unexpected frame-src loads or SafeFrame shim interactions; correlate with web request patterns indicating CSP bypass attempts in proxy or endpoint logs.

What your security team should do

• Prioritize patching all Firefox and Thunderbird instances to the specified fixed versions due to the XSS exposure
• Audit web compatibility extensions and tracking protection configurations
• Update inventory of affected Ubuntu systems running Wireshark and apply the listed package fixes
• Monitor EPSS and exploit maturity trends for any increase in activity