CVE-2024-9393 is a high-severity vulnerability in Firefox and Thunderbird that allows an attacker to execute arbitrary JavaScript under the resource://pdf.js origin via a specially crafted multipart response. This can enable access to cross-origin PDF content. On desktop clients, Site Isolation limits this access to same-site documents, but on Android versions, full cross-origin access is possible. The issue affects Firefox versions prior to 131, Firefox ESR versions prior to 128.3 and 115.16, and Thunderbird versions prior to 128.3 and 131. Mozilla has released fixes in Firefox 131, Firefox ESR 128.3, and Thunderbird 131 to address this vulnerability.