CVE-2024-0742: Mozilla Firefox Input Timing Vulnerability

CVE-2024-0742 Overview

CVE-2024-0742 affects Mozilla Firefox, Firefox ESR, and Thunderbird. The vulnerability stems from an incorrect timestamp used to prevent input on browser prompts and dialogs shortly after page load. An attacker who tricks a user into visiting a malicious page can cause prompts or dialogs to be activated or dismissed unintentionally. This condition falls under user interface confusion and requires user interaction to be exploited. Mozilla addressed the issue in Firefox 122, Firefox ESR 115.7, and Thunderbird 115.7. Debian shipped updates through its LTS advisory channel.

Critical Impact
Unintended dialog activation or dismissal can cause users to approve security-relevant actions such as file downloads or permission prompts without realizing it.

Affected Products

Mozilla Firefox versions prior to 122
Mozilla Firefox ESR versions prior to 115.7
Mozilla Thunderbird versions prior to 115.7 (also impacts Debian Linux 10 packages)

Discovery Timeline

2024-01-23 - CVE-2024-0742 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-0742

Vulnerability Analysis

The issue is a user interface confusion condition tracked in Mozilla Bug Report #1867152. Browsers enforce an input delay on sensitive prompts to prevent clickjacking and race conditions immediately following a page load. In the affected releases, the timestamp used to enforce this delay was incorrect. As a result, keystrokes or clicks queued before the prompt appeared could be consumed by the dialog. This allowed a crafted page to solicit input that the user believed was directed at page content but which instead activated or dismissed a browser prompt.

Root Cause

The root cause is an incorrect timestamp reference in the code path that gates user input on newly rendered browser prompts and dialogs. The delay check compared against a time value that did not correspond to when the prompt became visible. The window intended to block premature input was therefore not enforced. See Mozilla Security Advisory MFSA-2024-01 for the vendor description.

Attack Vector

Exploitation requires user interaction with a malicious or attacker-controlled web page. The attacker times a prompt or dialog to appear while the user is actively clicking or typing on the page. Because the input delay is not correctly applied, the pre-existing input reaches the dialog and triggers a confirmation or dismissal the user did not intend. No authentication is required, and the attack is delivered over the network via normal web traffic.

No verified exploit code is publicly available. Refer to Mozilla Security Advisory MFSA-2024-02 and MFSA-2024-04 for vendor technical detail.

Detection Methods for CVE-2024-0742

Indicators of Compromise

Firefox, Firefox ESR, or Thunderbird processes running versions below 122, 115.7, and 115.7 respectively on enterprise endpoints.
Browser telemetry showing unexpected file download confirmations, permission grants, or dialog dismissals shortly after page navigation events.
Access logs referencing pages that programmatically open dialogs (window.confirm, window.prompt, download prompts) immediately after load.

Detection Strategies

Inventory installed browser and mail client versions and flag hosts running vulnerable builds against the fixed versions listed by Mozilla.
Correlate proxy or DNS logs with browser process telemetry to identify users visiting pages that render prompts within milliseconds of navigation.
Use endpoint telemetry to identify Firefox or Thunderbird child processes spawning downloaded executables shortly after page load, which may indicate a dialog was auto-confirmed.

Monitoring Recommendations

Monitor software inventory feeds for Firefox and Thunderbird versions and enforce a minimum patched version through configuration management.
Track user reports of prompts appearing to click themselves or dismissing without action, and route them to the security team.
Log and review file downloads originating from browser sessions, particularly executables, scripts, and archives received without a user-initiated save action.

How to Mitigate CVE-2024-0742

Immediate Actions Required

Upgrade Firefox to version 122 or later on all managed endpoints.
Upgrade Firefox ESR to 115.7 or later where the ESR channel is required.
Upgrade Thunderbird to 115.7 or later on all mail client installations.
On Debian 10 systems, apply the packages referenced in the Debian LTS Announcement January 2024 and the follow-up advisory.

Patch Information

Mozilla shipped fixes in Firefox 122, Firefox ESR 115.7, and Thunderbird 115.7. Vendor advisories are published at MFSA-2024-01, MFSA-2024-02, and MFSA-2024-04. Debian LTS backported the fix through package updates to Thunderbird and Firefox ESR for Debian 10.

Workarounds

No vendor-supplied workaround exists; apply the patched versions.
Restrict browsing to trusted sites via web filtering while patching is in progress.
Advise users to avoid interacting with unfamiliar pages that display unexpected dialogs, and to close such tabs rather than clicking through prompts.

bash

# Verify installed Firefox version on Linux endpoints
firefox --version

# Debian/Ubuntu: apply security updates
sudo apt-get update && sudo apt-get install --only-upgrade firefox-esr thunderbird