CVE-2024-7524

What it actually does

DOM Clobbering on web-compatibility shims bypasses Content Security Policy strict-dynamic mode, enabling cross-site scripting in affected Firefox releases.

Why it matters to the business

Attackers can run unauthorized code in users' browsers on protected sites, risking data theft, session hijacking, and loss of user trust.

How an attack unfolds

An attacker locates a site using strict-dynamic CSP, injects an HTML element that clobbers the tracking-script shims added by Enhanced Tracking Protection, and executes arbitrary scripts despite the policy.

How to fix it

Upgrade Firefox to version 129 or later, Firefox ESR to 115.14 or later, and Firefox ESR to 128.1 or later.

How to confirm the fix worked

Verify installed browser versions against the fixed releases and confirm that strict-dynamic CSP pages reject injected elements that previously allowed script execution.

Typical attack path

1. Locate a target site enforcing Content Security Policy in strict-dynamic mode
2. Inject a crafted HTML element that collides with shim object names
3. Trigger DOM Clobbering to replace shim references
4. Bypass CSP restrictions and execute attacker-controlled script

How to detect it

Review browser console logs and web server access logs on strict-dynamic CSP pages for unexpected script sources or failed CSP violations that coincide with element injection patterns.

What your security team should do

• Prioritize browser updates across all endpoints to the versions listed in remediation guidance
• Audit internal web applications for strict-dynamic CSP usage and test for similar clobbering vectors
• Enable centralized browser update enforcement and logging of script injection attempts