CVE detail
CVE-2024-1554 — CVE-2024-1554
Published 2024-02-20 · Modified 2026-06-17 · Vendor mozilla · Product firefox · Source nvd
CRITICAL
severity
CVSS-derived band
0.0038
EPSS probability
exploitation probability, 30d
31.0%
EPSS percentile
percentile vs all CVEs
NOT LISTED
CISA KEV
known exploited catalog
Description
The `fetch()` API and navigation incorrectly shared the same cache, as the cache key did not include the optional headers `fetch()` may contain. Under the correct circumstances, an attacker may have been able to poison the local browser cache by priming it with a `fetch()` response controlled by the additional headers. Upon navigation to the same URL, the user would see the cached response instead of the expected response. This vulnerability affects Firefox < 123.
Remediation
No vendor-published fix data in our corpus for this CVE. Check the references below or the vendor's PSIRT / security advisories page.
References