CVE-2024-11702
📋 TL;DR
This vulnerability in Firefox and Thunderbird on Android allows sensitive data copied from Private Browsing tabs (like passwords) to be unintentionally stored in cloud-based clipboard history if that feature is enabled. It affects users of Firefox < 133 and Thunderbird < 133 on Android devices with cloud clipboard enabled. The issue stems from improper handling of private browsing data.
💻 Affected Systems
- Firefox for Android
- Thunderbird for Android
📦 What is this software?
Firefox by Mozilla
Thunderbird by Mozilla
⚠️ Risk & Real-World Impact
Worst Case
Sensitive information like passwords, credit card numbers, or personal data copied during private browsing sessions could be stored in cloud clipboard services, potentially accessible to attackers with access to the cloud account or through clipboard monitoring malware.
Likely Case
Users who copy passwords or other sensitive data in private browsing tabs may have that data stored in their cloud clipboard history, making it potentially visible to anyone with access to their cloud account or clipboard sync services.
If Mitigated
If cloud clipboard is disabled or users avoid copying sensitive data in private browsing mode, the risk is eliminated.
🎯 Exploit Status
Exploitation requires user interaction (copying data in private browsing) and cloud clipboard to be enabled. No remote exploitation possible.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Firefox 133, Thunderbird 133
Vendor Advisory: https://www.mozilla.org/security/advisories/mfsa2024-63/
Restart Required: Yes
Instructions:
1. Open Google Play Store. 2. Search for Firefox or Thunderbird. 3. Update to version 133 or higher. 4. Restart the application after update.
🔧 Temporary Workarounds
Disable Cloud Clipboard
androidTurn off cloud-based clipboard history to prevent any data from being stored in cloud services
Avoid Copying Sensitive Data in Private Browsing
allDo not copy passwords or other sensitive information while using Private Browsing tabs
🧯 If You Can't Patch
- Disable cloud clipboard sync in Android settings
- Use alternative browsers without cloud clipboard features for sensitive activities
🔍 How to Verify
Check if Vulnerable:
Check Firefox/Thunderbird version in app settings. If version < 133 and cloud clipboard is enabled, you are vulnerable.Check Version:
In Firefox/Thunderbird: Settings → About Firefox/ThunderbirdVerify Fix Applied:
Update to version 133 or higher and verify version in app settings.📡 Detection & Monitoring
Log Indicators:
- No specific log indicators for this client-side vulnerability
Network Indicators:
- No network-based detection possible
SIEM Query:
Not applicable for client-side Android application vulnerability