CVE-2024-5693

What it actually does

Offscreen Canvas failed to properly enforce cross-origin tainting checks, allowing JavaScript to read pixel data from images loaded from a different origin in violation of the same-origin policy.

Why it matters to the business

Attackers could steal image content from other websites a user visits, leading to unauthorized data exposure and potential privacy violations for users of affected browsers.

How an attack unfolds

An attacker hosts a malicious page that loads a cross-origin image into an Offscreen Canvas element; due to the missing taint tracking, the page reads back the image data and exfiltrates it, bypassing intended isolation between sites.

How to fix it

Upgrade Firefox to version 127 or later, Firefox ESR to 115.12 or later, and Thunderbird to 115.12 or later. Apply updates through the browser's built-in update mechanism as soon as they become available.

How to confirm the fix worked

Confirm installed browser versions meet or exceed the fixed releases listed above; re-test cross-origin canvas image access using proof-of-concept scripts in a controlled environment to verify the taint check now blocks access.

Typical attack path

1. Attacker lures victim to a controlled webpage
2. Page creates an OffscreenCanvas and draws a cross-origin image into it
3. Script calls getImageData or toDataURL on the canvas
4. Browser incorrectly returns the image pixels instead of blocking access
5. Data is sent to attacker-controlled server

How to detect it

Review browser process logs and crash reports for unusual canvas operations; correlate with web proxy or endpoint telemetry showing unexpected cross-origin image fetches followed by data exfiltration patterns.

What your security team should do

• Immediately deploy browser updates to all managed endpoints
• Monitor vendor advisories for any follow-on patches
• Educate users on the importance of keeping browsers current
• Review web application code that relies on canvas for image handling to ensure it does not assume cross-origin protections