CVE-2024-9394

What it actually does

An attacker can execute arbitrary JavaScript under the resource://devtools origin via a specially crafted multipart response, enabling access to cross-origin JSON content with full cross-origin access possible on Android clients due to limited Site Isolation enforcement.

Why it matters to the business

Attackers could steal sensitive cross-origin data from users of affected browser versions, increasing risk of credential theft or data exposure in environments relying on these clients, with urgency heightened by mentions in espionage and financially motivated campaigns.

How an attack unfolds

An attacker delivers a malicious multipart response that exploits the flaw to run JavaScript in the privileged devtools origin; on Android this bypasses same-site restrictions allowing full cross-origin JSON reads, consistent with observed 2024 zero-day exploitation patterns by espionage and financial actors.

How to fix it

Upgrade Firefox to version 131 or later, Firefox ESR to 128.3 or later and 115.16 or later, Thunderbird to 128.3 or later and 131 or later; apply patches immediately given the published date and threat actor context.

How to confirm the fix worked

Verify client versions meet or exceed the listed fixed releases and confirm the devtools origin no longer processes crafted multipart responses by testing with controlled payloads in isolated environments.

Typical attack path

1. Craft and host a malicious multipart HTTP response targeting the devtools origin
2. Trick a user into triggering the response in an affected Firefox or Thunderbird client
3. Execute injected JavaScript to access and exfiltrate cross-origin JSON data
4. Leverage obtained data for further attacks such as session hijacking or espionage

How to detect it

Search browser process logs, network captures, and security event logs for unexpected JavaScript execution or data access originating from the devtools resource URI, cross-referencing with known campaign indicators from espionage actors.

• resource://devtools
• multipart response with unexpected script execution
• cross-origin JSON fetch from devtools origin

What your security team should do

• Prioritize patching all desktop and Android clients within the CISA-style remediation window
• Monitor threat intelligence feeds for continued mentions of the listed 2024 exploitation campaigns
• Enforce browser auto-update policies across the organization
• Review logging for anomalous devtools origin activity post-patch