CVE-2024-2611 — The UI Performs the Wrong Action in Mozilla Firefox
CWE-449 — The UI Performs the Wrong ActionCWE-190 — Integer Overflow or Wraparound14 documents8 sources
Severity
5.5MEDIUMNVD
OSV6.5
EPSS
0.3%
top 44.60%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedMar 19
Latest updateDec 27
Description
A missing delay on when pointer lock was used could have allowed a malicious page to trick a user into granting permissions. This vulnerability affects Firefox < 124, Firefox ESR < 115.9, and Thunderbird < 115.9.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:LExploitability: 2.1 | Impact: 3.4
Affected Packages8 packages
Also affects: Debian Linux 10.0
🔴Vulnerability Details
5GHSA▶
GHSA-63p7-87m3-8c9v: A missing delay on when pointer lock was used could have allowed a malicious page to trick a user into granting permissions↗2024-03-19
CVEList▶
CVE-2024-2611: A missing delay on when pointer lock was used could have allowed a malicious page to trick a user into granting permissions↗2024-03-19
OSV▶
CVE-2024-2611: A missing delay on when pointer lock was used could have allowed a malicious page to trick a user into granting permissions↗2024-03-19