CVE-2024-0751 is a privilege escalation in Firefox in which a malicious devtools extension could gain more rights than intended. NVD scores it 8.8 High and Mozilla rates it Moderate. Mozilla fixed it in Firefox 122 and Firefox ESR 115.7, so update.
What's affected
The record says Firefox before 122, Firefox ESR before 115.7 and Thunderbird before 115.7 are affected. Mozilla advisories mfsa2024-01 and mfsa2024-02 list the fix in Firefox 122 and Firefox ESR 115.7. The pages I read did not list Thunderbird for this CVE, so confirm it on the Thunderbird advisory. The weakness is CWE-269, improper privilege management. Mozilla credits the report to Rob Wu.
The CVSS vector in the record is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. Source conflict: NVD gives 8.8 (High) while Mozilla rates the issue Moderate. The difference reflects the precondition that a malicious extension must already be installed, which the NVD vector does not capture. Treat the higher figure as the planning number.
How to check if you're exposed
In Firefox, open the menu, choose Help, then About Firefox, and read the version. It will also start an update check. For a scripted check, the command line reports it:
firefox --version
On Debian or Ubuntu systems that use the distribution package, dpkg -l firefox-esr thunderbird lists the installed package versions. Distribution packages carry their own version strings, so read the distributor's advisory for the mapping.
Browsers are also embedded in other tools, so look beyond the desktop icon. Kiosks, managed images and portable copies often lag behind.
What to do now
- Update Firefox, Firefox ESR or Thunderbird to a fixed version listed above.
- Restart the application. Updates apply fully only after a restart.
- In managed fleets, push the update through your software management tool and report on machines that have not restarted.
- If you cannot update at once, reduce risk by avoiding untrusted sites and by not opening untrusted mail attachments or links in Thunderbird.
- Keep automatic updates on so the next Mozilla security advisory reaches users without a ticket.
Why it matters
Browser extensions run with permissions the user approves. Devtools extensions add panels to the developer tools and get access to the page under inspection. The flaw lets such an extension go beyond what it was granted, according to Mozilla.
The practical risk depends on the extension. An attacker needs the user to install a malicious one first, which is why Mozilla rates it lower. Still, extension stores and sideloaded add-ons are a known route for unwanted code, so after updating, review installed extensions and remove ones you do not use.
The record does not mark this CVE as known exploited, and the Mozilla advisories I read do not say it has been used in attacks. Browser vulnerabilities are patched in bulk each cycle, so the right habit is to keep the whole fleet current rather than track single CVEs.
If the affected component is something your own code pulls in as a dependency, the free in-browser dependency scan at gold.safeguard.sh/scan will tell you whether it appears in your manifests. Reachability analysis then helps you separate the copies that your code actually exercises from the ones that only sit in the tree.
Quick check
Can this be exploited without an extension?
Mozilla describes a malicious devtools extension as the vehicle, so the user must install one first.
How do I review extensions?
In Firefox, open the menu, choose Add-ons and themes, and look at the Extensions list. Remove anything you do not need.
Sources
Last reviewed: 19 October 2026.
