CVE-2024-2609 — Product UI does not Warn User of Unsafe Actions in Mozilla Firefox
Severity
6.1MEDIUMNVD
OSV6.5
EPSS
1.1%
top 21.80%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedMar 19
Latest updateApr 25
Description
The permission prompt input delay could expire while the window is not in focus. This makes it vulnerable to clickjacking by malicious websites. This vulnerability affects Firefox < 124, Firefox ESR < 115.10, and Thunderbird < 115.10.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.7
Affected Packages8 packages
Also affects: Debian Linux 10.0
🔴Vulnerability Details
5CVEList▶
CVE-2024-2609: The permission prompt input delay could expire while the window is not in focus↗2024-03-19
OSV▶
CVE-2024-2609: The permission prompt input delay could expire while the window is not in focus↗2024-03-19
GHSA▶
GHSA-xr62-xhf5-qw2c: The permission prompt input delay could have expired while the window is not in focus, which made the prompt vulnerable to clickjacking by malicious w↗2024-03-19
📋Vendor Advisories
7Debian▶
CVE-2024-2609: firefox - The permission prompt input delay could expire while the window is not in focus....↗2024