CVE-2024-10460 is a moderate severity vulnerability in Firefox and Thunderbird where the origin of an external protocol handler prompt could be obscured by using a data: URL within an iframe. This could confuse users about the true source of the prompt. The issue affects Firefox versions prior to 132 and Firefox ESR versions prior to 128.4, as well as Thunderbird versions prior to 128.4 and 132. Mozilla has fixed this vulnerability in Firefox 132 and Firefox ESR 128.4.