CVE-2024-11700

Malicious websites may have been able to perform user intent confirmation through tapjacking. This could have led to users unknowingly approving the launch of external applications, potentially exposing them to underlying vulnerabilities. This vulnerability affects Firefox < 133 and Thunderbird < 133.

• CWE-1021

• https://bugzilla.mozilla.org/show_bug.cgi?id=1836921Issue Tracking
• https://www.mozilla.org/security/advisories/mfsa2024-63/Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2024-67/Vendor Advisory

Published

Nov 26, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-11695A crafted URL containing Arabic script and whitespace charac…5.4
• CVE-2024-11696The application failed to account for exceptions thrown by t…5.4
• CVE-2024-11697When handling keypress events, an attacker may have been abl…8.8
• CVE-2024-11698A flaw in handling fullscreen transitions may have inadverte…9.8
• CVE-2024-11699Memory safety bugs present in Firefox 132, Firefox ESR 128.4…8.8
• CVE-2024-1170The Post Form – Registration Form – Profile Form for User Pr…8.2
• CVE-2024-11701The incorrect domain may have been displayed in the address …4.3
• CVE-2024-11702Copying sensitive information from Private Browsing tabs on …7.5
• CVE-2024-11703On Android, Firefox may have inadvertently allowed viewing s…5.7
• CVE-2024-11704A double-free issue could have occurred in `sec_pkcs7_decode…9.8
• CVE-2024-11705`NSC_DeriveKey` inadvertently assumed that the `phKey` param…9.1
• CVE-2024-11706A null pointer dereference may have inadvertently occurred i…6.5