CVE-2024-5687: 
NixOS vulnerability analysis and mitigation

CVE-2024-5687 is a security vulnerability affecting Firefox for Android versions prior to 127, discovered by researcher jackyzy823. The vulnerability was disclosed on June 11, 2024, and involves an incorrect principal assignment when opening new tabs. This issue specifically affects only Firefox for Android, while other versions of Firefox are unaffected (Mozilla Advisory).

The vulnerability occurs when a specific sequence of actions is performed while opening a new tab, causing the triggering principal associated with the new tab to be incorrectly assigned. The triggering principal is responsible for calculating various security-related values, including the Referer and Sec-* headers. This incorrect assignment could potentially lead to improper security checks within the browser and result in incorrect or misleading information being sent to remote websites. The vulnerability has been assigned a CVSS 3.1 base score of 5.3 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N (NVD).

The vulnerability could potentially lead to incorrect security checks within the browser and result in the transmission of incorrect or misleading information to remote websites. This could affect the browser's security mechanisms and potentially compromise the integrity of web communications (Mozilla Advisory).

The vulnerability has been rated with a 'high' impact by Mozilla. However, there are currently no reports of this vulnerability being actively exploited in the wild (CIS Advisory).

Users are advised to update their Firefox for Android installations to version 127 or later, which contains the fix for this vulnerability. No specific workarounds have been provided for users who cannot immediately update their browsers (Mozilla Advisory).