CVE-2024-8388
MEDIUMFirefox < 130.0 - UI Spoofing via Fullscreen Transition Notification Obscuring
Title source: llmDescription
Multiple prompts and panels from both Firefox and the Android OS could be used to obscure the notification announcing the transition to fullscreen mode after the fix for CVE-2023-6870 in Firefox 121. This could lead to spoofing the browser UI if the sudden appearance of the prompt distracted the user from noticing the visual transition happening behind the prompt. These notifications now use the Android Toast feature. *This bug only affects Firefox on Android. Other operating systems are unaffected.* This vulnerability affects Firefox < 130.
References (3)
Core 3
Core References
Issue Tracking, Permissions Required
https://bugzilla.mozilla.org/show_bug.cgi?id=1902996
Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2024-39/
Scores
CVSS v3
5.3
EPSS
0.0034
EPSS Percentile
25.8%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
partial
Details
CWE
CWE-1021
Status
published
Products (1)
mozilla/firefox
< 130.0
Published
Sep 03, 2024
Tracked Since
Feb 18, 2026