CVE-2024-11696

Summary

CVE-2024-11696 is a vulnerability affecting Firefox versions below 133 and Firefox ESR below 128.5, as well as Thunderbird versions below 133 and Thunderbird ESR below 128.5. The flaw lies in the application's handling of the `loadManifestFromFile` method during add-on signature verification. An invalid or unsupported extension manifest can trigger exceptions, leading to runtime errors that disrupt the signature validation process. This may bypass the enforcement of signature validation for unrelated add-ons, allowing potentially tampered third-party applications to run. The vulnerability can impact the security and integrity of user extensions in the affected browsers.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.