CVE-2024-26283

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

An attacker could have executed unauthorized scripts on top origin sites using a JavaScript URI when opening an external URL with a custom Firefox scheme. This vulnerability affects Firefox for iOS < 123.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-83

Affected software

Vendor	Product	Versions
Mozilla	Firefox for iOS	>= unspecified, < 123
mozilla	firefox	< 123
mozilla	firefox	< 123

References

https://bugzilla.mozilla.org/show_bug.cgi?id=1850158Issue Tracking
https://www.mozilla.org/security/advisories/mfsa2024-08/Vendor Advisory
https://bugzilla.mozilla.org/show_bug.cgi?id=1850158Issue Tracking
https://www.mozilla.org/security/advisories/mfsa2024-08/Vendor Advisory

Timeline

Published: Feb 22, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-262846.1Utilizing a 302 redirect, an attacker could have conducted a Universal Cross-Site Scripting (UXSS) on a victim website, if the victim had a CVE-2024-262888.7An unauthenticated remote attacker can influence the communication due to the lack of encryption of sensitive data via a MITM. Charging is n CVE-2024-262899.8Deserialization of Untrusted Data vulnerability in PMB Services PMB allows Remote Code Inclusion.This issue affects PMB: from 7.5.1 before 7 CVE-2024-26294.3Incorrect security UI in iOS in Google Chrome prior to 123.0.6312.58 allowed a remote attacker to perform UI spoofing via a crafted HTML pag CVE-2024-262908.7Improper Input Validation vulnerability in Avid Avid NEXIS E-series on Linux, Avid Avid NEXIS F-series on Linux, Avid Avid NEXIS PRO+ on Lin CVE-2024-262918.7An Unauthenticated Arbitrary File Read vulnerability affects the Agent when installed on a system. The parameter filename does not validate CVE-2024-262927.1An authenticated Arbitrary File Deletion vulnerability enables an attacker to delete critical files. This issue affects Avid NEXIS E-series:CVE-2024-262938.7The Avid Nexis Agent uses a vulnerable gSOAP version. An undocumented vulnerability impacting gSOAP v2.8 makes the application vulnerable to CVE-2024-262948.8Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands on CVE-2024-262958.8Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands on CVE-2024-262968.8Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands on CVE-2024-262978.8Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands on