CVE-2024-3863
CriticalCVSS 9.8Exploitation Probability (EPSS)
Elevated risk57th percentile - higher than 57% of all known CVEs
Summary
The executable file warning was not presented when downloading .xrm-ms files. This issue only affected Windows operating systems. This vulnerability affects Firefox < 125, Firefox ESR < 115.10, and Thunderbird < 115.10.
Risk Assessment
A Windows user may download a .xrm-ms file without an executable-content warning. This increases the risk of an unaware user running a malicious file.
Recommendation
Update Firefox to version 125 or later, Firefox ESR to 115.10 or later, and Thunderbird to 115.10 or later. Exercise caution when downloading .xrm-ms files.
Other vulnerabilities in Firefox
See all- CVE-2026-113470Medium
Mozilla blocked compromised intermediate eMudhra certificates via OneCRL on October 17, and the list was distributed to clients via RemoteSettings the same day. This update contains the updated OneCRL block list, ensuring clients will block the compromised certificates even if RemoteSettings is disabled by policy or otherwise unavailable in the user's network environment. The vulnerability was fixed in Firefox 158.0.1, Firefox ESR 153.5.1, Firefox ESR 115.43.1, Thunderbird 158.0.1, and Thunderbird 153.5.1.
- CVE-2026-113401Medium
A denial-of-service vulnerability exists in the PDF Viewer component. The vulnerability was fixed in Firefox 158.0.1 and Thunderbird 158.0.1.
- CVE-2026-117920Critical
Use-after-free vulnerability in the DOM: HTML Parser component of Firefox and Thunderbird. It was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
- CVE-2026-117917Critical
Invalid pointer vulnerability in the Graphics: WebRender component of Firefox and Thunderbird. It was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
- CVE-2026-117868Critical
Sandbox escape vulnerability in the DOM: Networking component of Firefox and Thunderbird. It may allow bypassing process isolation mechanisms. Fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
- CVE-2026-117862Critical
Privilege escalation vulnerability due to incorrect boundary conditions in the Networking component of Firefox and Thunderbird. It may allow gaining higher privileges within the process. Fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
- CVE-2026-117861Critical
Sandbox escape vulnerability in the DOM: Navigation component of Firefox and Thunderbird. It may allow bypassing process isolation and gaining higher privileges. Fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
- CVE-2026-109780Critical
Vulnerability in the DOM: Core & HTML component allows mitigation bypass. This issue was fixed in Firefox 158 and Thunderbird 158.
- CVE-2026-109774Critical
Invalid pointer and undefined behavior in the DOM: Notifications component. Fixed in Firefox 158 and Thunderbird 158.
- CVE-2026-109772Critical
Same-origin policy bypass in the DevTools component. Fixed in Firefox 158 and Thunderbird 158.
Original NVD description (English source)
The executable file warning was not presented when downloading .xrm-ms files. *Note: This issue only affected Windows operating systems. Other operating systems are unaffected.* This vulnerability affects Firefox < 125, Firefox ESR < 115.10, and Thunderbird < 115.10.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS