CVE-2024-7526

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

ANGLE failed to initialize parameters which lead to reading from uninitialized memory. This could be leveraged to leak sensitive data from memory. This vulnerability affects Firefox < 129, Firefox ESR < 115.14, Firefox ESR < 128.1, Thunderbird < 128.1, and Thunderbird < 115.14.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-908

Affected software

Vendor	Product	Versions
Mozilla	Firefox	>= unspecified, < 129
Mozilla	Firefox ESR	>= unspecified, < 115.14
Mozilla	Firefox ESR	>= unspecified, < 128.1
Mozilla	Thunderbird	>= unspecified, < 128.1
Mozilla	Thunderbird	>= unspecified, < 115.14
mozilla	firefox	< 129
mozilla	firefox_esr	< 115.14; < 128.1
mozilla	thunderbird	< 128.1; < 115.14

References

https://bugzilla.mozilla.org/show_bug.cgi?id=1910306Issue Tracking, Permissions Required
https://www.mozilla.org/security/advisories/mfsa2024-33/Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2024-34/Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2024-35/Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2024-37/Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2024-38/Vendor Advisory

Timeline

Published: Aug 6, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-75278.8Unexpected marking work at the start of sweeping could have led to a use-after-free. This vulnerability affects Firefox < 129, Firefox ESR <CVE-2024-75288.8Incorrect garbage collection interaction in IndexedDB could have led to a use-after-free. This vulnerability affects Firefox < 129, Firefox CVE-2024-75296.5The date picker could partially obscure security prompts. This could be used by a malicious site to trick a user into granting permissions. CVE-2024-75308.8Incorrect garbage collection interaction could have led to a use-after-free. This vulnerability affects Firefox < 129.CVE-2024-75316.5Calling `PK11_Encrypt()` in NSS using CKM_CHACHA20 and the same buffer for input and output can result in plaintext on an Intel Sandy Bridge CVE-2024-75328.8Out of bounds memory access in ANGLE in Google Chrome prior to 127.0.6533.99 allowed a remote attacker to potentially exploit heap corruptio CVE-2024-75338.8Use after free in Sharing in Google Chrome on iOS prior to 127.0.6533.99 allowed a remote attacker to potentially exploit heap corruption vi CVE-2024-75348.8Heap buffer overflow in Layout in Google Chrome prior to 127.0.6533.99 allowed a remote attacker to potentially exploit heap corruption via CVE-2024-75358.8Inappropriate implementation in V8 in Google Chrome prior to 127.0.6533.99 allowed a remote attacker to potentially exploit heap corruption CVE-2024-75368.8Use after free in WebAudio in Google Chrome prior to 127.0.6533.99 allowed a remote attacker to potentially exploit heap corruption via a cr CVE-2024-75375.5oFono QMI SMS Handling Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows local attackers to disclose sensit CVE-2024-75387.8oFono CUSD AT Command Stack-based Buffer Overflow Code Execution Vulnerability. This vulnerability allows local attackers to execute arbitra