CVE-2024-8382

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Internal browser event interfaces were exposed to web content when privileged EventHandler listener callbacks ran for those events. Web content that tried to use those interfaces would not be able to use them with elevated privileges, but their presence would indicate certain browser features had been used, such as when a user opened the Dev Tools console. This vulnerability affects Firefox < 130, Firefox ESR < 128.2, Firefox ESR < 115.15, Thunderbird < 128.2, and Thunderbird < 115.15.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-273

Affected software

No affected versions have been published.

Timeline

Published: Sep 3, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-83837.5Firefox normally asks for confirmation before asking the operating system to find an application to handle a scheme that the browser does no CVE-2024-83849.8The JavaScript garbage collector could mis-color cross-compartment objects if OOM conditions were detected at the right point between two pa CVE-2024-83859.8A difference in the handling of StructFields and ArrayTypes in WASM could be used to trigger an exploitable type confusion vulnerability. Th CVE-2024-83866.1If a site had been granted the permission to open popup windows, it could cause Select elements to appear on top of another site to perform CVE-2024-83879.8Memory safety bugs present in Firefox 129, Firefox ESR 128.1, and Thunderbird 128.1. Some of these bugs showed evidence of memory corruption CVE-2024-83885.3Multiple prompts and panels from both Firefox and the Android OS could be used to obscure the notification announcing the transition to full CVE-2024-83899.8Memory safety bugs present in Firefox 129. Some of these bugs showed evidence of memory corruption and we presume that with enough effort so CVE-2024-83917.5In Eclipse Vert.x version 4.3.0 to 4.5.9, the gRPC server does not limit the maximum length of message payload (Maven GAV: io.vertx:vertx-gr CVE-2024-83927.2The WordPress Post Grid Layouts with Pagination – Sogrid plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, a CVE-2024-83936.6The Woocommerce Blocks – Woolook plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.7.0 via CVE-2024-83946.5When aborting the verification of an OTR chat session, an attacker could have caused a use-after-free bug leading to a potentially exploitab CVE-2024-83959.8FlyCASS CASS and KCM systems did not correctly filter SQL queries, which made them vulnerable to attack by outside attackers with no authe