CVE-2024-1550
MEDIUMFirefox < 123 and ESR < 115.8 - UI Spoofing via Fullscreen and Pointer Lock
Title source: llmDescription
A malicious website could have used a combination of exiting fullscreen mode and `requestPointerLock` to cause the user's mouse to be re-positioned unexpectedly, which could have led to user confusion and inadvertently granting permissions they did not intend to grant. This vulnerability affects Firefox < 123, Firefox ESR < 115.8, and Thunderbird < 115.8.
References (6)
Core 6
Core References
Issue Tracking
https://bugzilla.mozilla.org/show_bug.cgi?id=1860065
Mailing List, Vendor Advisory
https://lists.debian.org/debian-lts-announce/2024/03/msg00001.html
Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2024-05/
Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2024-06/
Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2024-07/
Scores
CVSS v3
6.1
EPSS
0.0057
EPSS Percentile
42.7%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
partial
Details
CWE
CWE-1021
Status
published
Products (4)
debian/debian_linux
10.0
mozilla/firefox
< 115.8.0
mozilla/firefox
< 123.0
mozilla/thunderbird
< 115.8.0
Published
Feb 20, 2024
Tracked Since
Feb 18, 2026