CVE-2024-11697

When handling keypress events, an attacker may have been able to trick a user into bypassing the "Open Executable File?" confirmation dialog. This could have led to malicious code execution. This vulnerability affects Firefox < 133, Firefox ESR < 128.5, Thunderbird < 133, and Thunderbird < 128.5.

• CWE-94

• https://bugzilla.mozilla.org/show_bug.cgi?id=1842187Issue Tracking
• https://www.mozilla.org/security/advisories/mfsa2024-63/Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2024-64/Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2024-67/Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2024-68/Vendor Advisory
• https://lists.debian.org/debian-lts-announce/2024/11/msg00029.html

Published

Nov 26, 2024

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-11691Certain WebGL operations on Apple silicon M series devices c…8.8
• CVE-2024-11692An attacker could cause a select dropdown to be shown over a…4.3
• CVE-2024-11693The executable file warning was not presented when downloadi…9.8
• CVE-2024-11694Enhanced Tracking Protection's Strict mode may have inadvert…6.1
• CVE-2024-11695A crafted URL containing Arabic script and whitespace charac…5.4
• CVE-2024-11696The application failed to account for exceptions thrown by t…5.4
• CVE-2024-11698A flaw in handling fullscreen transitions may have inadverte…9.8
• CVE-2024-11699Memory safety bugs present in Firefox 132, Firefox ESR 128.4…8.8
• CVE-2024-1170The Post Form – Registration Form – Profile Form for User Pr…8.2
• CVE-2024-11700Malicious websites may have been able to perform user intent…8.1
• CVE-2024-11701The incorrect domain may have been displayed in the address …4.3
• CVE-2024-11702Copying sensitive information from Private Browsing tabs on …7.5