CVE-2024-0750: Mozilla Firefox Auth Bypass Vulnerability

CVE-2024-0750 Overview

CVE-2024-0750 is a user interface security flaw in Mozilla Firefox, Firefox ESR, and Thunderbird. The vulnerability stems from a bug in the popup notifications delay calculation. Attackers can exploit this miscalculation to trick users into granting sensitive browser permissions without realizing it.

The issue affects Firefox versions before 122, Firefox ESR before 115.7, and Thunderbird before 115.7. Successful exploitation requires user interaction with a malicious web page. The flaw maps to [CWE-451] (User Interface Misrepresentation of Critical Information) and falls under the Social Engineering and User Interface Confusion category.

Critical Impact
An attacker controlling a malicious website can bypass the safety delay on permission prompts, leading users to unintentionally approve access to cameras, microphones, geolocation, or other sensitive browser capabilities.

Affected Products

Mozilla Firefox versions before 122
Mozilla Firefox ESR versions before 115.7
Mozilla Thunderbird versions before 115.7
Debian Linux 10.0 distributions shipping the affected Mozilla packages

Discovery Timeline

2024-01-23 - CVE-2024-0750 published to the National Vulnerability Database
2025-06-20 - Last updated in NVD database

Technical Details for CVE-2024-0750

Vulnerability Analysis

Firefox displays popup notifications when websites request privileged capabilities such as camera, microphone, geolocation, or notification access. The browser enforces a deliberate delay before these prompts can accept user input. This delay protects users from clickjacking and timing-based deception by ensuring the prompt is visible and acknowledged before any click is registered.

The vulnerability stems from incorrect delay calculation in the popup notification subsystem. A malicious page can manipulate timing so that the prompt accepts input sooner than intended. Users clicking on unrelated page content can have those clicks registered against a permission dialog they did not consciously evaluate.

The issue is tracked in Mozilla Bug Report #1863083 and detailed in Mozilla Security Advisory MFSA-2024-01.

Root Cause

The root cause is a logic error in how Firefox computes the activation delay window for permission popups. Under specific conditions, the delay is shorter than the documented safety threshold. This allows synthetic or mistimed user input events to be treated as informed consent for permission grants.

Attack Vector

Exploitation requires the victim to visit an attacker-controlled web page. The attacker stages a UI element (a button, modal, or game-like interaction) that captures user clicks. By triggering a permission request at a precisely calculated moment, the attacker aligns the prompt with the user's intended click target. The browser counts the click as approval for the requested permission.

No verified public proof-of-concept code is available for this issue. Technical analysis is described in prose only; readers should consult the Mozilla advisories for implementation specifics.

Detection Methods for CVE-2024-0750

Indicators of Compromise

Browser telemetry showing unexpected grants of camera, microphone, geolocation, or notifications permissions to recently visited domains
User reports of permission prompts appearing and dismissing faster than expected
Web traffic to low-reputation domains immediately preceding new permission grants in Firefox profile data (permissions.sqlite)

Detection Strategies

Inventory endpoints running Firefox below 122, Firefox ESR below 115.7, or Thunderbird below 115.7 using software asset management tooling
Correlate browser version data with web proxy logs to identify users visiting untrusted sites on vulnerable builds
Review enterprise policy reports for unexpected sites appearing in granted-permission lists

Monitoring Recommendations

Forward Firefox application and update logs to a centralized logging platform for version-drift monitoring
Alert on Mozilla product installations that fail to update within the patch cycle window
Track DNS and proxy traffic to domains flagged in Mozilla and Debian advisories

How to Mitigate CVE-2024-0750

Immediate Actions Required

Upgrade Firefox to version 122 or later on all managed endpoints
Upgrade Firefox ESR to 115.7 or later for environments standardized on the extended release channel
Upgrade Thunderbird to 115.7 or later on systems where the mail client is deployed
Apply Debian package updates referenced in the Debian LTS Announcement and the companion Debian LTS Announcement

Patch Information

Mozilla released fixes in Firefox 122, Firefox ESR 115.7, and Thunderbird 115.7. Refer to Mozilla Security Advisory MFSA-2024-01, Mozilla Security Advisory MFSA-2024-02, and Mozilla Security Advisory MFSA-2024-04 for product-specific patch metadata.

Workarounds

Use enterprise policy to disable websites from requesting camera, microphone, geolocation, and notifications permissions until patches are deployed
Configure Firefox policies.json to restrict permission prompts on unmanaged sites
Restrict browsing on vulnerable builds to a vetted allowlist enforced through a secure web gateway

bash

# Example Firefox enterprise policy to block permission prompts
# Place in /etc/firefox/policies/policies.json (Linux) or equivalent OS path
{
  "policies": {
    "Permissions": {
      "Camera":       { "BlockNewRequests": true },
      "Microphone":   { "BlockNewRequests": true },
      "Location":     { "BlockNewRequests": true },
      "Notifications":{ "BlockNewRequests": true }
    },
    "DisableAppUpdate": false
  }
}