CVE-2024-10004

Opening an external link to an HTTP website when Firefox iOS was previously closed and had an HTTPS tab open could in some cases result in the padlock icon…

Critical · published October 15, 2024

CVSS v3.1
9.1
EPSS
0%
Percentile
30.9
In the wild
Unconfirmed
What it is

🔥 A sneaky hiccup in Firefox for iOS means that a simple external link could trick you into thinking you're safe when you're not! Think of it like walking into a restaurant where the door says 'Open' but the back kitchen is actually still cooking up some questionable leftovers — that padlock should tell you your data is secure, but sometimes it just gets confused! If you're not careful, an attacker could exploit this vulnerability, leading you to believe you're browsing securely (HTTPS) when you might actually be on an insecure (HTTP) connection. This could expose your sensitive information, like passwords and personal data, to prying eyes. The consequences could be absolutely devastating if you're not aware of the switch!

Put simply

Think of it like walking into a restaurant where the door says 'Open' but the back kitchen is actually still cooking up some questionable leftovers — that padlock should tell you your data is secure, but sometimes it just gets confused! This vulnerability occurs when Firefox for iOS shows an HTTPS indicator when the app was previously closed with an HTTPS tab open, but later opens an HTTP link, potentially misleading users about their security status.

What to do

If you're not careful, an attacker could exploit this vulnerability, leading you to believe you're browsing securely (HTTPS) when you might actually be on an insecure (HTTP) connection. This could expose your sensitive information, like passwords and personal data, to prying eyes. The consequences could be absolutely devastating if you're not aware of the switch! To protect yourself, immediately update Firefox for iOS to version 131.2 or higher. Additionally, always double-check the URL bar before entering any sensitive information, even if the padlock is present. Better safe than sorry! You've got this! Follow these steps, and you'll be browsing safely again in no time. 🛡️

The record
Technical detail
CVSS v3.1
9.1 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00381 · 30.9th percentile
Published
2024-10-15T21:29Z
EPSS history
Timeline
  • 15 OCT 21:29Z
    Opening an external link to an HTTP website when Firefox iOS was previously closed and had an HTTPS tab open could in some cases result in the padlock icon…
    cvelistv5