CVE-2024-9393

What it actually does

Specially crafted multipart responses allow arbitrary JavaScript execution under the resource://pdf.js origin, bypassing same-origin restrictions to read cross-origin PDF content; desktop Site Isolation limits scope to same-site documents while Android permits unrestricted cross-origin access.

Why it matters to the business

Attackers could silently exfiltrate sensitive PDF documents viewed in the browser, increasing risk of data leakage and compliance violations on mobile deployments; low exploit maturity and stable low EPSS reduce immediate urgency but mobile users remain exposed until patched.

How an attack unfolds

An attacker serving malicious content triggers a multipart response that causes pdf.js to execute attacker-controlled JavaScript; the script then fetches and exfiltrates cross-origin PDF data, with full success possible on Android clients.

How to fix it

Upgrade Firefox to 131 or later, Firefox ESR to 128.3 or 115.16 or later, and Thunderbird to 128.3 or 131 or later; apply patches immediately on Android devices where isolation is absent.

How to confirm the fix worked

Verify browser and ESR versions against the fixed releases; test PDF rendering with crafted multipart responses in a lab environment to confirm isolation enforcement.

Typical attack path

1. Deliver malicious web content or response to victim browser
2. Trigger multipart response handling in pdf.js
3. Execute JavaScript under pdf.js origin
4. Access and exfiltrate cross-origin PDF content

How to detect it

Review web proxy and browser logs for unusual multipart responses interacting with pdf.js; examine network traffic for unexpected JavaScript execution originating from resource://pdf.js when loading PDFs.

What your security team should do

• Prioritize patching all Android Firefox deployments within the next 48 hours
• Enforce automatic updates for desktop Firefox and Thunderbird instances
• Monitor for any new exploit maturity signals given the 740 days since publication