CVE-2024-6606VulnerabilityPublished 9 Jul 2024Updated 4 Nov 2025

CVE-2024-6606: Mozilla Firefox · Vulnerability

Affects Mozilla FirefoxSource CVE Database V5

Not known to be exploited · CVSS 8.2 High : upgrade to 128 soon.

Data as of 26 Oct 2026, 06:26 UTC

CVSS 3.1 base score

8.2High

How severe the flaw is on the 0–10 CVSS scale.

EPSS: 0.3% chance of exploitation in 30 days – higher than 33% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Patch: Available – fixed in 128

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:L

Attack Vector: Network
Attack Complexity: Low
Privileges Required: None
User Interaction: Required
Scope: Changed
Confidentiality: High
Integrity: None
Availability: Low

Bold values are the worst case: easiest to exploit or largest impact.

Attack Vector: Network: The vulnerable component is bound to the network stack and the set of possible attackers extends beyond the other options listed, up to and including the entire Internet. Such a vulnerability is often termed 'remotely exploitable' and can be thought of as an attack being exploitable at the protocol level one or more network hops away (e.g., across one or more routers).
Attack Complexity: Low: Specialized access conditions or extenuating circumstances do not exist. An attacker can expect repeatable success against the vulnerable component.
Privileges Required: None: The attacker is unauthorized prior to attack, and therefore does not require any access to settings or files to carry out an attack.
User Interaction: Required: Successful exploitation of this vulnerability requires a user to take some action before the vulnerability can be exploited.
Scope: Changed: An exploited vulnerability can affect resources beyond the security scope managed by the security authority of the vulnerable component. In this case, the vulnerable component and the impacted component are different and managed by different security authorities.
Confidentiality: High: There is total loss of confidentiality, resulting in all resources within the impacted component being divulged to the attacker. Alternatively, access to only some restricted information is obtained, but the disclosed information presents a direct, serious impact.
Integrity: None: There is no loss of integrity within the impacted component.
Availability: Low: Performance is reduced or there are interruptions in resource availability. Even if repeated exploitation of the vulnerability is possible, the attacker does not have the ability to completely deny service to legitimate users. The resources in the impacted component are either partially available all of the time, or fully available only some of the time, but overall there is no direct, serious consequence to the impacted component.

Definitions: FIRST CVSS v3.1 specification.

Exploitation evidence

Disclosed: evidence found.
CVE published 9 Jul 2024
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 2026-10-26.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade Mozilla Firefox to 128.

Affected software

Product	Affected	Fixed in
Mozilla Firefox	Affected <128	Fixed in 128

AI-suggested

European organizations should implement the following specific mitigations: 1) Immediately plan and deploy updates to Firefox and Thunderbird version 128 or later once available, as this is the definitive fix. 2) Until patches are applied, restrict clipboard access through browser group policies or enterprise configuration management to limit exposure to untrusted content. 3) Educate users about the risks of interacting with unknown or suspicious websites and email content that could trigger clipboard operations. 4) Employ endpoint detection and response (EDR) tools to monitor for unusual clipboard activity or application crashes related to Firefox and Thunderbird. 5) Use network security controls to block or flag traffic to known malicious domains that could host exploit content. 6) Review and tighten browser sandboxing and content security policies to reduce the attack surface. 7) Conduct vulnerability scanning and penetration testing focused on client applications to identify unpatched systems. 8) Coordinate with IT teams to ensure rapid incident response capability in case exploitation attempts are detected. These measures go beyond generic advice by focusing on clipboard-specific controls and user interaction vectors.

Description

Clipboard code failed to check the index on an array access. This could have led to an out-of-bounds read. This vulnerability affects Firefox < 128 and Thunderbird < 128.

Impact

For European organizations, the primary impact of CVE-2024-6606 is the potential exposure of sensitive information through out-of-bounds memory reads triggered by clipboard operations in Firefox and Thunderbird. This could lead to leakage of confidential data such as credentials, personal information, or proprietary content. The vulnerability does not allow modification of data or code execution but could facilitate further attacks by revealing memory contents. Availability impact is limited but could manifest as application crashes or instability. Organizations relying heavily on Firefox and Thunderbird for communication and browsing, especially in sectors like finance, government, and critical infrastructure, face increased risk. The vulnerability's remote exploitability without privileges but requiring user interaction means phishing or malicious web content could be vectors. Given the widespread use of these applications in Europe, the threat could affect a broad range of users and systems, potentially undermining trust and compliance with data protection regulations such as GDPR if data leakage occurs.

CWE-125Out-of-bounds Read (opens in a new tab)
Base weaknessCWE Top 25 (2025): #8
The product reads data past the end, or before the beginning, of the intended buffer.
Implementation · Input Validation
Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
Architecture and Design · Language Selection
Use a language that provides appropriate memory abstractions.
OWASP Cheat Sheets
XML Security (opens in a new tab)
Mass Assignment (opens in a new tab)
OWASP ASVS 4.0.3
V13.3.1 (opens in a new tab)
V5.1.4 (opens in a new tab)
V5.1.3 (opens in a new tab)
Attack patterns
Overread Buffers (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 6 Nov 2025, 18:34 UTC

WeaknessesCWE-125

Technical details

References

Community reviews

Related threats