CVE-2024-9394: 
NixOS vulnerability analysis and mitigation

CVE-2024-9394 is a high-severity security vulnerability discovered in Mozilla products that affects Firefox < 131, Firefox ESR < 128.3, Firefox ESR < 115.16, Thunderbird < 128.3, and Thunderbird < 131. The vulnerability was disclosed on October 1, 2024, and was reported by security researcher Masato Kinugawa (Mozilla Advisory).

The vulnerability allows an attacker to execute arbitrary JavaScript under the resource://devtools origin through a specially crafted multipart response. The severity is rated as HIGH with a CVSS v3.1 base score of 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). The vulnerability is classified as CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (NVD).

The vulnerability enables access to cross-origin JSON content, with varying levels of impact depending on the platform. On desktop clients, the access is limited to "same site" documents due to the Site Isolation feature. However, on Android versions, full cross-origin access is possible, making the vulnerability more severe on mobile platforms (Mozilla Advisory).

Mozilla has addressed this vulnerability in Firefox 131, Firefox ESR 128.3, Firefox ESR 115.16, Thunderbird 128.3, and Thunderbird 131. Users are advised to update their software to these or later versions to mitigate the risk (Mozilla Advisory).