CVE-2024-11698

mediumpriority · track · 0EPSS 0.007 · 53 %ileDEEURUUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

0.69% (53rd) EPSS

CVSS 4.3 · medium

Is it mine?

38 products

Check your exposure

Who says so?

4 sources

cnnvd · enisa_euvd · fstec_bdu · cert_bund

EPSS · scored 2026-10-27

A flaw in handling fullscreen transitions may have inadvertently caused the application to become stuck in fullscreen mode when a modal dialog was opened during the transition. This issue left users unable to exit fullscreen mode using standard actions like pressing "Esc" or accessing right-click menus, resulting in a disrupted browsing experience until the browser is restarted. *This bug only affects the application when running on macOS. Other operating systems are unaffected.* This vulnerability affects Firefox < 133, Firefox ESR < 128.5, Thunderbird < 133, and Thunderbird < 128.5.

cvss

Technical severity, 0–10. One row per scoring source.

9.8

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–critical · 4.3–9.8

v3.14.3mediumAV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:Lsecondary · FSTEC (BDU) RU

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · ENISA EU

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondaryexploitability 3.9 · impact 5.9

v3.19criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:Usecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: none · Automatable: yes · Technical Impact: totalcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-404USCWE-755US

affected products (38)

Products and version ranges known to be affected.

Amazon Linux 2all versionscert_bundDEcpe:/o:amazon:linux_2:-
Debian Linuxall versionscert_bundDEcpe:/o:debian:debian_linux:-
Fedora Linuxall versionscert_bundDEcpe:/o:fedoraproject:fedora:-
Gentoo Linuxall versionscert_bundDEcpe:/o:gentoo:linux:-
Mozilla Firefox <133all versionscert_bundDE
Mozilla Firefox ESR <115.18all versionscert_bundDE
Mozilla Firefox ESR <128.5all versionscert_bundDE
Mozilla Firefox iOS <133all versionscert_bundDE
Mozilla Thunderbird <115.18all versionscert_bundDE
Mozilla Thunderbird <128.5all versionscert_bundDE
Mozilla Thunderbird <133all versionscert_bundDE
Oracle Linuxall versionscert_bundDEcpe:/o:oracle:linux:-
RESF Rocky Linuxall versionscert_bundDEcpe:/o:resf:rocky_linux:-
Red Hat Enterprise Linuxall versionscert_bundDEcpe:/o:redhat:enterprise_linux:-
SUSE Linuxall versionscert_bundDEcpe:/o:suse:suse_linux:-
SUSE openSUSEall versionscert_bundDEcpe:/o:suse:opensuse:-
Ubuntu Linuxall versionscert_bundDEcpe:/o:canonical:ubuntu_linux:-
Xerox FreeFlow Print Server 9all versionscert_bundDEcpe:/a:xerox:freeflow_print_server:9
Mozilla Firefox≤ iOS <133cert_bundDE
Mozilla Firefox< 133cert_bundDE

showing 20 of 38

advisories (1)

Vendor and ecosystem advisories describing this.

WID-SEC-W-2024-3549Mozilla Firefox und Thunderbird: Mehrere SchwachstellenDeutsch2024-11-26csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Mozilla Firefox, Mozilla Firefox ESR und Mozilla Thunderbird ausnutzen, um beliebigen Code auszuführen, vertrauliche Informationen preiszugeben, Sicherheitsmaßnahmen zu umgehen oder Cross-Site-Scripting- oder Spoofing-Angriffe durchzuführen.

also known as (8)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu cert_bund NVD CVE.org MITRE

published 2024-11-26modified 2026-06-17

references (18)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan