CVE-2024-4769

What it actually does

Error messages during Web Worker resource imports distinguish application/javascript responses from non-script responses, enabling cross-origin information disclosure about resource types.

Why it matters to the business

Attackers may learn details about cross-origin content, aiding reconnaissance that could lead to targeted follow-on attacks or unintended exposure of sensitive resource information across websites.

How an attack unfolds

An attacker hosts a page that loads a Web Worker attempting to import a cross-origin resource; by observing whether error messages indicate a script response or not, the attacker infers the content type of the target resource without direct access.

How to fix it

Upgrade Firefox to 126 or later, Firefox ESR to 115.11 or later, and Thunderbird to 115.11 or later to eliminate the distinguishing error messages.

How to confirm the fix worked

Confirm installed versions meet or exceed the fixed releases; in lab environments, attempt cross-origin Web Worker imports on patched versus unpatched builds and verify uniform error handling.

Typical attack path

1. Host a malicious webpage containing a Web Worker script
2. Direct the worker to attempt importing a chosen cross-origin URL
3. Inspect error messages returned to the worker or main thread
4. Differentiate script versus non-script responses to map resource types
5. Leverage gathered information for further targeted attacks

How to detect it

Exploitation leaves minimal persistent artifacts; review browser console or telemetry logs for unusual Web Worker import attempts originating from external domains and correlate with cross-origin fetch patterns.

What your security team should do

• Apply browser and Thunderbird updates immediately across all endpoints
• Enforce automatic update policies for Mozilla products
• Review web application designs that rely on cross-origin resource isolation
• Monitor Mozilla security advisories for related regressions