CVE-2024-7525

What it actually does

A web extension granted only minimal host permissions can instantiate a StreamFilter object that intercepts and alters HTTP response bodies for arbitrary origins, bypassing the intended permission model for cross-site data access.

Why it matters to the business

Attackers can silently exfiltrate or tamper with sensitive web content across any visited site, increasing risk of credential theft, session hijacking, and data manipulation; the high volume of Firefox and Thunderbird deployments amplifies exposure for organizations relying on these browsers.

How an attack unfolds

An attacker convinces a target to install a seemingly benign extension, then uses the extension to create a StreamFilter on any request; the filter reads or rewrites response bodies in real time. Named actors involved in 2024 zero-day campaigns by espionage and financially motivated groups have been observed leveraging similar browser extension weaknesses.

How to fix it

Upgrade Firefox to 129 or later, Firefox ESR to 115.14 or 128.1 or later, and Thunderbird to 128.1 or 115.14 or later. Remove any untrusted extensions and enforce extension allow-listing policies until patches are applied.

How to confirm the fix worked

Verify installed browser and extension versions against the fixed releases above; inspect about:config or extension manifests for unexpected StreamFilter usage; re-test with a minimal-permission extension to confirm interception is blocked.

Typical attack path

1. User installs a low-permission web extension from an untrusted source
2. Extension registers a listener and instantiates a StreamFilter for target origins
3. Filter callback inspects or modifies response bodies of cross-origin requests
4. Exfiltrated or altered data is sent to attacker-controlled infrastructure

How to detect it

Review browser extension installation logs and about:addons activity for recent additions; inspect network logs for unexpected outbound traffic immediately following extension loads; correlate with process execution of firefox or thunderbird binaries spawning child processes that access network APIs.

What your security team should do

• Prioritize patching Firefox and Thunderbird instances within 48 hours given the permission-bypass nature and reported campaign activity
• Audit installed extensions for minimal-permission grants and revoke unnecessary host permissions
• Enable enterprise extension management policies to restrict sideloading
• Monitor EPSS and threat-intel feeds for any rise in observed exploitation