CVE-2024-8389
Memory safety bugs present in Firefox 129. Some of these bugs showed evidence of memory...
Memory safety bugs present in Firefox 129. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 130.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Memory safety bugs present in Firefox 129. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 130.
- Record
CVE-2024-8389- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-787, CWE-119
- Updated
- 2026-11-02
CVE List
Memory safety bugs present in Firefox 129. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 130.
- Record
CVE-2024-8389- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-119
- Updated
- 2026-11-02
EUVDEUVD-2024-49145
Memory safety bugs present in Firefox 129. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 130.
- Record
EUVD-2024-49145- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-pm7g-mpjq-33gr
Memory safety bugs present in Firefox 129. Some of these bugs showed evidence of memory...
Memory safety bugs present in Firefox 129. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 130.
- Record
GHSA-pm7g-mpjq-33gr- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-119, CWE-787
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2024-8389
Memory safety bugs present in Firefox 129. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 130.
- Record
UBUNTU-CVE-2024-8389- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVopenSUSE-SU-2024:14358-1No score
MozillaFirefox-130.0.1-1.1 on GA media
These are all security issues fixed in the MozillaFirefox-130.0.1-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:14358-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:11373-1No score
firefox-esr-153.0-1.1 on GA media
These are all security issues fixed in the firefox-esr-153.0-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:11373-1- Updated
- 2026-11-02
OSVUSN-6992-1No score
firefox vulnerabilities
Multiple security issues were discovered in Firefox. If a user were tricked into opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service, obtain sensitive information across domains, or execute arbitrary code. (CVE-2024-8382, CVE-2024-8383, CVE-2024-8386, CVE-2024-8387, CVE-2024-8389)
Nils Bars discovered that Firefox contained a type confusion vulnerability when performing certain property name lookups. An attacker could potentially exploit this issue to cause a denial of service, or execute arbitrary code. (CVE-2024-8381)
It was discovered that Firefox did not properly manage memory during garbage collection. An attacker could potentially exploit this issue to cause a denial of service, or execute arbitrary code. (CVE-2024-8384)
Seunghyun Lee discovered that Firefox contained a type confusion vulnerability when handling certain ArrayTypes. An attacker could potentially exploit this issue to cause a denial of service, or execute arbitrary code. (CVE-2024-8385)
- Record
USN-6992-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
mozjs52Ubuntu:18.04:LTS | All versions, plus listed versions 52.3.1-0ubuntu352.3.1-7fakesync152.8.1-0ubuntu0.18.04.152.9.1-0ubuntu0.18.04.1 | None known |
mozjs38Ubuntu:18.04:LTS | All versions, plus listed versions 38.8.0~repack1-0ubuntu138.8.0~repack1-0ubuntu338.8.0~repack1-0ubuntu4 | None known |
firefoxUbuntu:20.04:LTS | before 130.0+build2-0ubuntu0.20.04.1, plus listed versions 69.0.3+build1-0ubuntu170.0+build2-0ubuntu170.0+build2-0ubuntu270.0.1+build1-0ubuntu271.0+build2-0ubuntu2 Show 45 moreShow less71.0+build5-0ubuntu172.0.1+build1-0ubuntu172.0.2+build1-0ubuntu173.0+build1-0ubuntu173.0+build2-0ubuntu173.0+build3-0ubuntu173.0.1+build1-0ubuntu174.0+build1-0ubuntu174.0+build2-0ubuntu174.0+build2-0ubuntu274.0+build3-0ubuntu175.0+build3-0ubuntu176.0+build2-0ubuntu0.20.04.176.0.1+build1-0ubuntu0.20.04.177.0.1+build1-0ubuntu0.20.04.178.0.1+build1-0ubuntu0.20.04.178.0.2+build2-0ubuntu0.20.04.179.0+build1-0ubuntu0.20.04.180.0+build2-0ubuntu0.20.04.180.0.1+build1-0ubuntu0.20.04.181.0+build2-0ubuntu0.20.04.181.0.2+build1-0ubuntu0.20.04.182.0+build2-0ubuntu0.20.04.182.0.2+build1-0ubuntu0.20.04.182.0.3+build1-0ubuntu0.20.04.183.0+build2-0ubuntu0.20.04.184.0+build3-0ubuntu0.20.04.184.0.1+build1-0ubuntu0.20.04.184.0.2+build1-0ubuntu0.20.04.185.0+build1-0ubuntu0.20.04.185.0.1+build1-0ubuntu0.20.04.186.0+build3-0ubuntu0.20.04.186.0.1+build1-0ubuntu0.20.04.187.0+build3-0ubuntu0.20.04.288.0+build2-0ubuntu0.20.04.188.0.1+build1-0ubuntu0.20.04.289.0+build2-0ubuntu0.20.04.289.0.1+build1-0ubuntu0.20.04.189.0.2+build1-0ubuntu0.20.04.190.0+build1-0ubuntu0.20.04.190.0.2+build1-0ubuntu0.20.04.191.0+build2-0ubuntu0.20.04.191.0.1+build1-0ubuntu0.20.04.191.0.2+build1-0ubuntu0.20.04.192.0+build3-0ubuntu0.20.04.1 | 130.0+build2-0ubuntu0.20.04.1 |
mozjs68Ubuntu:20.04:LTS | All versions, plus listed versions 68.5.0-1~fakesync68.5.0-2~fakesync68.6.0-168.6.0-1ubuntu1 | None known |
mozjs52Ubuntu:20.04:LTS | All versions, plus listed versions 52.9.1-1build152.9.1-1ubuntu3 | None known |
mozjs102Ubuntu:22.04:LTS | All versions, plus listed versions 102.11.0-0ubuntu0.22.04.1102.12.0-0ubuntu0.22.04.1102.13.0-0ubuntu0.22.04.1102.15.1-0ubuntu0.22.04.1 | None known |
mozjs78Ubuntu:22.04:LTS | All versions, plus listed versions 78.13.0-178.15.0-278.15.0-4ubuntu1 | None known |
mozjs91Ubuntu:22.04:LTS | All versions, plus listed versions 91.5.1-0ubuntu191.6.0-191.6.0-291.7.0-291.10.0-0ubuntu1 | None known |
mozjs102Ubuntu:24.04:LTS | All versions, plus listed versions 102.15.1-1102.15.1-3ubuntu2 | None known |
mozjs115Ubuntu:24.04:LTS | All versions, plus listed versions 115.3.0-0ubuntu1115.4.0-2115.5.0-1115.6.0-1115.7.0-4 Show 4 moreShow less115.8.0-1115.9.0-1115.9.0-1build1115.10.0-1 | None known |
firefoxUbuntu:20.04:LTS From an advisory covering 8 CVEs | before 130.0+build2-0ubuntu0.20.04.1, plus listed versions 69.0.3+build1-0ubuntu170.0+build2-0ubuntu170.0+build2-0ubuntu270.0.1+build1-0ubuntu271.0+build2-0ubuntu2 Show 45 moreShow less71.0+build5-0ubuntu172.0.1+build1-0ubuntu172.0.2+build1-0ubuntu173.0+build1-0ubuntu173.0+build2-0ubuntu173.0+build3-0ubuntu173.0.1+build1-0ubuntu174.0+build1-0ubuntu174.0+build2-0ubuntu174.0+build2-0ubuntu274.0+build3-0ubuntu175.0+build3-0ubuntu176.0+build2-0ubuntu0.20.04.176.0.1+build1-0ubuntu0.20.04.177.0.1+build1-0ubuntu0.20.04.178.0.1+build1-0ubuntu0.20.04.178.0.2+build2-0ubuntu0.20.04.179.0+build1-0ubuntu0.20.04.180.0+build2-0ubuntu0.20.04.180.0.1+build1-0ubuntu0.20.04.181.0+build2-0ubuntu0.20.04.181.0.2+build1-0ubuntu0.20.04.182.0+build2-0ubuntu0.20.04.182.0.2+build1-0ubuntu0.20.04.182.0.3+build1-0ubuntu0.20.04.183.0+build2-0ubuntu0.20.04.184.0+build3-0ubuntu0.20.04.184.0.1+build1-0ubuntu0.20.04.184.0.2+build1-0ubuntu0.20.04.185.0+build1-0ubuntu0.20.04.185.0.1+build1-0ubuntu0.20.04.186.0+build3-0ubuntu0.20.04.186.0.1+build1-0ubuntu0.20.04.187.0+build3-0ubuntu0.20.04.288.0+build2-0ubuntu0.20.04.188.0.1+build1-0ubuntu0.20.04.289.0+build2-0ubuntu0.20.04.289.0.1+build1-0ubuntu0.20.04.189.0.2+build1-0ubuntu0.20.04.190.0+build1-0ubuntu0.20.04.190.0.2+build1-0ubuntu0.20.04.191.0+build2-0ubuntu0.20.04.191.0.1+build1-0ubuntu0.20.04.191.0.2+build1-0ubuntu0.20.04.192.0+build3-0ubuntu0.20.04.1 | 130.0+build2-0ubuntu0.20.04.1 |
MozillaFirefoxopenSUSE:Tumbleweed From an advisory covering 9 CVEs | before 130.0.1-1.1 | 130.0.1-1.1 |
firefox-esropenSUSE:Tumbleweed From an advisory covering 228 CVEs | before 153.0-1.1 | 153.0-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-8389 is a critical vulnerability (CVSS 9.8) in Mozilla Firefox, published September 3, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.49%, the 42nd percentile. Fixed in firefox 130.0+build2-0ubuntu0.20.04.1.
References
bugzilla.mozilla.org/buglist.cgi?bug_id=1907230%2C1909367
mozilla.org/security/advisories/mfsa2024-39
nvd.nist.gov/vuln/detail/CVE-2024-8389
github.com/advisories/GHSA-pm7g-mpjq-33gr
ubuntu.com/security/CVE-2024-8389
cve.org/CVERecord?id=CVE-2024-8389
Show 194 moreShow less
lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/5S76WFG23P4ITMRS7RGPVTUJR3KZSV24
suse.com/security/cve/CVE-2024-8381
Left out here: 138 versions and 51 references. The JSON record has them.