CVE-2024-0750 — User Interface (UI) Misrepresentation of Critical Information in Mozilla Firefox

CWE-451 — User Interface (UI) Misrepresentation of Critical Information CWE-1021 — UI Misrepresentation / Clickjacking14 documents8 sources

Severity

8.8HIGHNVD

OSV6.5

EPSS

1.5%

top 18.98%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Mozilla Firefox Mozilla Firefox ESR Mozilla Thunderbird +1 more

Timeline

PublishedJan 23

Latest updateMar 4

Description

A bug in popup notifications delay calculation could have made it possible for an attacker to trick a user into granting permissions. This vulnerability affects Firefox < 122, Firefox ESR < 115.7, and Thunderbird < 115.7.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages9 packages

▶CVEListV5mozilla/firefoxunspecified — 122

▶NVDmozilla/firefox< 122.0

▶CVEListV5mozilla/firefox_esrunspecified — 115.7

▶NVDmozilla/firefox_esr< 115.7

▶Ubuntumozilla/firefox< 122.0+build2-0ubuntu0.20.04.1

Also affects: Debian Linux 10.0

🔴Vulnerability Details

OSV

thunderbird vulnerabilities↗2024-03-04

▶

OSV

firefox regressions↗2024-02-07

▶

OSV

firefox vulnerabilities↗2024-01-29

▶

OSV

CVE-2024-0750: A bug in popup notifications delay calculation could have made it possible for an attacker to trick a user into granting permissions↗2024-01-23

▶

GHSA

GHSA-pw8j-6xcp-c453: A bug in popup notifications delay calculation could have made it possible for an attacker to trick a user into granting permissions↗2024-01-23

▶

📋Vendor Advisories

Ubuntu

Thunderbird vulnerabilities↗2024-03-04

▶

Ubuntu

Firefox vulnerabilities↗2024-01-29

▶

Red Hat

Mozilla: Potential permissions request bypass via clickjacking↗2024-01-23

▶

Debian

CVE-2024-0750: firefox - A bug in popup notifications delay calculation could have made it possible for a...↗2024

▶

Mozilla

Mozilla Foundation Security Advisory 2024-01: CVE-2024-0750↗

▶