CVE-2024-6611

What it actually does

A nested iframe triggering cross-site navigation can transmit SameSite=Strict or Lax cookies, bypassing the browser's cookie isolation restrictions.

Why it matters to the business

Attackers may gain unauthorized access to user sessions or sensitive data, leading to account compromise and potential data breaches with urgent patching required due to the high CVSS and public disclosure.

How an attack unfolds

An attacker hosts malicious content containing nested iframes that force a cross-site navigation, causing the browser to include restricted cookies in the request and allowing session hijacking or unauthorized actions.

How to fix it

Upgrade Firefox to version 128 or later and Thunderbird to version 128 or later. For the listed package apply onevpl-intel-gpu fixed in 24.3.3-1.

How to confirm the fix worked

Confirm the browser or package version meets or exceeds the fixed release; test cookie behavior with nested iframe navigation scenarios to verify SameSite restrictions are enforced.

Typical attack path

1. Attacker prepares a malicious site with nested iframes designed to trigger navigation
2. Victim visits the attacker-controlled page while authenticated to the target site
3. Cross-site navigation occurs and restricted SameSite cookies are sent
4. Attacker uses the cookies to impersonate the victim or perform privileged actions

How to detect it

Review web server and browser logs for unexpected cross-site navigation events involving cookie transmission; look for indicators of session use from unexpected origins after iframe interactions.

What your security team should do

• Prioritize immediate upgrade of all Firefox and Thunderbird instances to version 128+
• Monitor EPSS and exploit maturity for any increase in activity
• Review and enforce SameSite cookie attributes on all web applications as a defense-in-depth measure