CVE-2024-9399

What it actually does

A website can trigger a crash in the browser process by initiating a specially crafted WebTransport session, resulting in denial of service.

Why it matters to the business

Users face unexpected application crashes when visiting certain websites, interrupting workflows and risking loss of unsaved data across desktop environments.

How an attack unfolds

An attacker sets up a malicious site that starts a WebTransport session with crafted parameters; when a user visits the page, the session causes the Firefox or Thunderbird process to terminate.

How to fix it

Upgrade Firefox to 131 or later, Firefox ESR to 128.3 or later, and Thunderbird to 128.3 or later. Apply updates immediately given the public disclosure and stable EPSS trend.

How to confirm the fix worked

Confirm installed versions meet or exceed the fixed releases listed in vendor advisories and test that crafted WebTransport sessions no longer cause crashes.

Typical attack path

1. Attacker prepares a website configured to initiate a malicious WebTransport session
2. Victim loads the page in a vulnerable browser version
3. WebTransport handling triggers a process crash

How to detect it

Review browser crash logs and telemetry for entries tied to WebTransport session handling; correlate with web access logs showing visits to suspicious domains.

What your security team should do

• Apply the listed browser and email client updates across all managed systems without delay
• Monitor crash reports for WebTransport-related failures as an interim detection measure
• Review enterprise browser policies to enforce automatic updates