CVE-2024-0605 - Using a javascript: URI with a setTimeout race condition, an attacker can execute unauthorized scripts on top origin sites in urlbar

Back Back to CVE browser

HIGH

Using a javascript: URI with a setTimeout race condition, an attacker can execute unauthorized scripts on top origin sites in urlbar

Published Jan 22, 2024

7.5

HIGH

CVSS 3.1

EPSS 0.39%

Description

Using a javascript: URI with a setTimeout race condition, an attacker can execute unauthorized scripts on top origin sites in urlbar. This bypasses security measures, potentially leading to arbitrary code execution or unauthorized actions within the user's loaded webpage. This vulnerability affects Focus for iOS < 122.

Affected products

Vendor Mozilla Product Focus for iOS Default
n/a
- Version
  unspecified
  Status
  affected
  Constraints
  <122

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Mozilla

Focus for iOS

n/a

Version	Status	Constraints
unspecified	affected	<122

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-362

Race Condition

References (3)

https://bugzilla.mozilla.org/show_bug.cgi?id=1855575
Issue TrackingPermissions Required
https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-16398
Advisory
https://www.mozilla.org/security/advisories/mfsa2024-03/
Vendor Advisory

Link	Providers	Tags
https://bugzilla.mozilla.org/show_bug.cgi?id=1855575		Issue TrackingPermissions Required
https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-16398		Advisory
https://www.mozilla.org/security/advisories/mfsa2024-03/		Vendor Advisory