Description
Due to URL previews in the network panel of developer tools improperly storing URLs, query parameters could potentially be used to overwrite global objects in privileged code. This vulnerability affects Firefox < 110.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Mozilla | Firefox | unspecified – < 110 | 110 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 22.04 LTS | mozjs78 +1 | No fix yet | — |
| Ubuntu 20.04 LTS | firefox | 110.0+build3-0ubuntu0.20.04.1 | USN-5880-1 |
| Ubuntu 20.04 LTS | mozjs52 +1 | No fix yet | — |
| Ubuntu 18.04 LTS | firefox | 110.0+build3-0ubuntu0.18.04.1 | USN-5880-1 |
| Ubuntu 18.04 LTS | mozjs38 +1 | No fix yet | — |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | MozillaFirefox | 110.0.1-1.1 | openSUSE-SU-2024:12753-1 |
| openSUSE Tumbleweed | firefox-esr | 128.5.1-1.1 | openSUSE-SU-2024:14572-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2 | thunderbird | 102.8.0-1.amzn2.0.1 | ALAS2-2023-1983 |
Advisories 5
- USN-5880-1 firefox vulnerabilities Ubuntu Security Notices (USN) · Apr 22, 2026
- openSUSE-SU-2024:12753-1 MozillaFirefox-110.0.1-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:14572-1 firefox-esr-128.5.1-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- ALAS2-2023-1983 Important: thunderbird security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Feb 15, 2024
- WID-SEC-2023-0385 Mozilla Firefox: Mehrere Schwachstellen ermöglichen Codeausführung BSI CERT-Bund (WID) · Sep 27, 2023