CVE-2024-26281

MediumCVSS 4.7/10Last modified Jun 17, 2026

Description

Upon scanning a JavaScript URI with the QR code scanner, an attacker could have executed unauthorized scripts on the current top origin sites in the URL bar. This vulnerability affects Firefox for iOS < 123.

Metrics

CVSS 3.1 4.7/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Mozilla	Firefox for iOS	>= unspecified, < 123

References

https://bugzilla.mozilla.org/show_bug.cgi?id=1868005Issue Tracking
https://www.mozilla.org/security/advisories/mfsa2024-08/Vendor Advisory
https://bugzilla.mozilla.org/show_bug.cgi?id=1868005Issue Tracking
https://www.mozilla.org/security/advisories/mfsa2024-08/Vendor Advisory

Timeline

Published: Feb 22, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-262827.1Using an AMP url with a canonical element, an attacker could have executed JavaScript from an opened bookmarked page. This vulnerability aff CVE-2024-262837.8An attacker could have executed unauthorized scripts on top origin sites using a JavaScript URI when opening an external URL with a custom F CVE-2024-262846.1Utilizing a 302 redirect, an attacker could have conducted a Universal Cross-Site Scripting (UXSS) on a victim website, if the victim had a CVE-2024-262888.7An unauthenticated remote attacker can influence the communication due to the lack of encryption of sensitive data via a MITM. Charging is n CVE-2024-262899.8Deserialization of Untrusted Data vulnerability in PMB Services PMB allows Remote Code Inclusion.This issue affects PMB: from 7.5.1 before 7 CVE-2024-26294.3Incorrect security UI in iOS in Google Chrome prior to 123.0.6312.58 allowed a remote attacker to perform UI spoofing via a crafted HTML pag CVE-2024-262908.7Improper Input Validation vulnerability in Avid Avid NEXIS E-series on Linux, Avid Avid NEXIS F-series on Linux, Avid Avid NEXIS PRO+ on Lin CVE-2024-262918.7An Unauthenticated Arbitrary File Read vulnerability affects the Agent when installed on a system. The parameter filename does not validate CVE-2024-262927.1An authenticated Arbitrary File Deletion vulnerability enables an attacker to delete critical files. This issue affects Avid NEXIS E-series:CVE-2024-262938.7The Avid Nexis Agent uses a vulnerable gSOAP version. An undocumented vulnerability impacting gSOAP v2.8 makes the application vulnerable to CVE-2024-262948.8Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands on CVE-2024-262958.8Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands on