CVE-2024-0606
published 2024-01-22CVE-2024-0606: An attacker could execute unauthorized script on a legitimate site through UXSS using window.open() by opening a javascript URI leading to unauthorized actions…
PriorityP426medium6.1CVSS 3.1
AVNACLPRNUIRSCCLILAN
EPSS
0.28%
20.2th percentile
An attacker could execute unauthorized script on a legitimate site through UXSS using window.open() by opening a javascript URI leading to unauthorized actions within the user's loaded webpage. This vulnerability affects Focus for iOS < 122.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| mozilla | firefox | — | — |
| mozilla | firefox_focus | < 122.0 | 122.0 |
| mozilla | focus_for_ios | >= unspecified < 122 | 122 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Mozilla
Mozilla Foundation Security Advisory 2024-03: CVE-2024-0606
vendor_mozilla·CVSS 6.1
CVE-2024-0606 [MEDIUM] Mozilla Foundation Security Advisory 2024-03: CVE-2024-0606
Mozilla Foundation Security Advisory 2024-03
CVE: CVE-2024-0606
Product: Focus for iOS
Impact: high
Fixed in: Focus for iOS 122
GHSA
GHSA-p52c-9f7h-pxpj: An attacker could execute unauthorized script on a legitimate site through UXSS using window
ghsa_unreviewed·2024-01-22
CVE-2024-0606 [MEDIUM] CWE-79 GHSA-p52c-9f7h-pxpj: An attacker could execute unauthorized script on a legitimate site through UXSS using window
An attacker could execute unauthorized script on a legitimate site through UXSS using window.open() by opening a javascript URI leading to unauthorized actions within the user's loaded webpage. This vulnerability affects Focus for iOS < 122.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2024-01-22
Published