CVE-2024-26282
📋 TL;DR
This vulnerability in Firefox for iOS allows attackers to execute JavaScript on bookmarked AMP pages by manipulating canonical URLs. It affects Firefox for iOS users who have bookmarked AMP pages and are running vulnerable versions. The attack requires user interaction through opening a maliciously crafted bookmarked page.
💻 Affected Systems
- Firefox for iOS
📦 What is this software?
Firefox by Mozilla
⚠️ Risk & Real-World Impact
Worst Case
An attacker could execute arbitrary JavaScript in the context of the bookmarked page, potentially stealing session cookies, credentials, or performing actions on behalf of the user.
Likely Case
Limited JavaScript execution on specific bookmarked AMP pages, potentially enabling session hijacking or credential theft from affected sites.
If Mitigated
With proper patching, no impact as the vulnerability is fully addressed in Firefox 123+.
🎯 Exploit Status
Exploitation requires user interaction (opening a maliciously bookmarked page) but the technical execution is straightforward once the bookmark is created.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Firefox for iOS 123 and later
Vendor Advisory: https://www.mozilla.org/security/advisories/mfsa2024-08/
Restart Required: Yes
Instructions:
1. Open the App Store on your iOS device. 2. Search for Firefox. 3. Tap 'Update' if available. 4. If no update shows, pull down to refresh. 5. Install Firefox 123 or later.
🔧 Temporary Workarounds
Avoid AMP page bookmarks
allDo not bookmark AMP pages until Firefox is updated to version 123+
Use alternative browser
allTemporarily use Safari or another browser for AMP content
🧯 If You Can't Patch
- Avoid bookmarking AMP pages in Firefox for iOS
- Clear all existing AMP page bookmarks from Firefox for iOS
🔍 How to Verify
Check if Vulnerable:
Check Firefox version in iOS Settings > Firefox > About. If version is below 123, the device is vulnerable.Check Version:
Not applicable for iOS GUI app - check in Settings > Firefox > AboutVerify Fix Applied:
Confirm Firefox version is 123 or higher in iOS Settings > Firefox > About.📡 Detection & Monitoring
Log Indicators:
- Unusual JavaScript execution from bookmarked AMP pages
- Suspicious canonical URL parameters in page requests
Network Indicators:
- Requests to AMP pages with manipulated canonical URLs from Firefox iOS user agents
SIEM Query:
Not typically applicable as this is client-side mobile browser vulnerability