CVE-2024-38312

MediumCVSS 6.5/10Last modified Aug 19, 2026

Description

When browsing private tabs, some data related to location history or webpage thumbnails could be persisted incorrectly within the sandboxed app bundle after app termination This vulnerability affects Firefox for iOS < 127.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-922

Affected software

Vendor	Product	Versions
Mozilla	Firefox for iOS	>= unspecified, < 127

References

https://bugzilla.mozilla.org/show_bug.cgi?id=1878578Issue Tracking, Permissions Required
https://www.mozilla.org/security/advisories/mfsa2024-27/Vendor Advisory
https://bugzilla.mozilla.org/show_bug.cgi?id=1878578Issue Tracking, Permissions Required
https://www.mozilla.org/security/advisories/mfsa2024-27/Vendor Advisory

Timeline

Published: Jun 13, 2024
Last modified: Aug 19, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-383134.3In certain scenarios a malicious website could attempt to display a fake location URL bar which could mislead users as to the actual website CVE-2024-383145.9IBM Maximo Application Suite - Monitor Component 8.10, 8.11, and 9.0 could disclose information in the form of the hard-coded cryptographic CVE-2024-383156.5IBM Aspera Shares 1.0 through 1.10.0 PL3 does not invalidate session after a password reset which could allow an authenticated user to imper CVE-2024-383166.5IBM Aspera Shares 1.9.0 through 1.10.0 PL6 does not properly rate limit the frequency that an authenticated user can send emails, which coul CVE-2024-383174.8IBM Aspera Shares 1.9.0 through 1.10.0 PL6 is vulnerable to cross-site scripting. This vulnerability allows a privileged user to embed arbi CVE-2024-383186.1IBM Aspera Shares 1.9.0 through 1.10.0 PL6 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when v CVE-2024-383198.8IBM Security SOAR 51.0.2.0 could allow an authenticated user to execute malicious code loaded from a specially crafted script. IBM X-Force CVE-2024-38328.8Object corruption in V8 in Google Chrome prior to 124.0.6367.60 allowed a remote attacker to potentially exploit object corruption via a cra CVE-2024-383207.5IBM Storage Protect for Virtual Environments: Data Protection for VMware and Storage Protect Backup-Archive Client 8.1.0.0 through 8.1.23.0 CVE-2024-383216.5IBM Business Automation Workflow 22.0.2, 23.0.1, 23.0.2, and 24.0.0 stores potentially sensitive information in log files under certain situ CVE-2024-383227.5IBM Storage Defender - Resiliency Service 2.0.0 through 2.0.4 agent username and password error response discrepancy exposes product to brut CVE-2024-383246.5IBM Storage Defender 2.0.0 through 2.0.7 on-prem defender-sensor-cmd CLI does not validate server name during registration and unregistratio