CVE-2024-10462: Mozilla Firefox Origin Spoofing Vulnerability

CVE-2024-10462 Overview

CVE-2024-10462 is an origin spoofing vulnerability in Mozilla Firefox, Firefox ESR, and Thunderbird. The flaw stems from how the browser truncates long URLs when rendering permission prompts. An attacker who crafts a specially long URL can cause the origin displayed in the prompt to be truncated in a way that misrepresents the true origin. A user could then grant sensitive permissions such as camera, microphone, or geolocation access believing the request came from a trusted site. The issue is categorized under [CWE-290] Authentication Bypass by Spoofing and affects Firefox versions prior to 132, Firefox ESR prior to 128.4, and Thunderbird prior to 128.4 and 132.

Critical Impact
Attackers can trick users into granting powerful browser permissions to malicious origins by exploiting URL truncation in permission prompts.

Affected Products

Mozilla Firefox versions prior to 132
Mozilla Firefox ESR versions prior to 128.4
Mozilla Thunderbird versions prior to 128.4 and prior to 132

Discovery Timeline

2024-10-29 - CVE-2024-10462 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-10462

Vulnerability Analysis

The vulnerability resides in the permission prompt rendering path in Firefox and Thunderbird. When a web origin requests access to a protected capability such as geolocation, notifications, camera, or microphone, the browser displays a prompt that identifies the requesting origin. The rendering logic truncates URLs that exceed a display length threshold. An attacker can construct an origin string long enough to force truncation at a position that hides the real host and surfaces attacker-controlled text that resembles a legitimate origin.

The result is an integrity failure in the security user interface. Users rely on the prompt to make an informed trust decision, and truncation removes the visual anchor they need to identify the true requester. Consent granted under this deception is indistinguishable from consent granted to a trusted site.

Root Cause

The root cause is unsafe display truncation of untrusted origin strings without preserving the security-relevant portion of the URL. Instead of anchoring the truncation to the effective top-level domain and eTLD+1, the prompt truncated the string in a manner that could hide the true host. This is a classic origin spoofing pattern tracked as [CWE-290].

Attack Vector

Exploitation requires user interaction. An attacker hosts a page under a controlled origin whose URL is long enough to trigger the truncation behavior. The page invokes a permission-gated API such as navigator.geolocation.getCurrentPosition, navigator.mediaDevices.getUserMedia, or Notification.requestPermission. The prompt is rendered with a truncated origin that appears to reference a trusted domain. If the user accepts, the malicious origin obtains the requested permission.

The vulnerability manifests entirely in the client and does not require network privilege or authentication. Technical details are available in Mozilla Bug Report #1920423 and Mozilla Security Advisory MFSA-2024-55.

Detection Methods for CVE-2024-10462

Indicators of Compromise

Browser telemetry showing permission grants to origins with unusually long URLs or hostnames containing padding characters designed to force UI truncation.
Web proxy or DNS logs revealing user navigation to domains with lengthy subdomain chains immediately preceding sensitive permission-related activity.
Endpoint records of Firefox or Thunderbird versions below the patched baseline still active in the environment.

Detection Strategies

Inventory browser and mail client versions across managed endpoints and flag Firefox below 132, Firefox ESR below 128.4, and Thunderbird below 128.4 or 132.
Correlate web proxy logs with browser permission activity to surface sites requesting sensitive capabilities from newly registered or unusually long hostnames.
Review browser permission stores on managed hosts for grants issued to unfamiliar origins during the exposure window.

Monitoring Recommendations

Alert on outbound requests to hostnames exceeding 60 characters that also load pages invoking permission-gated Web APIs.
Track Firefox and Thunderbird update compliance through endpoint management tooling and generate exceptions for hosts running vulnerable builds.
Monitor Debian and other Linux distribution security channels, including the Debian LTS Announcement, for downstream package updates.

How to Mitigate CVE-2024-10462

Immediate Actions Required

Upgrade Firefox to version 132 or later on all managed endpoints.
Upgrade Firefox ESR to version 128.4 or later where extended support is in use.
Upgrade Thunderbird to version 128.4 or 132 or later across mail client deployments.
Audit granted browser permissions and revoke any entries tied to unrecognized long-form origins.

Patch Information

Mozilla addressed the issue in the releases documented across MFSA-2024-55, MFSA-2024-56, MFSA-2024-58, and MFSA-2024-59. Debian users should apply the updates announced in the Debian LTS Announcement #34 and Debian LTS Announcement #1.

Workarounds

Enforce browser auto-update through group policy or mobile device management to eliminate lingering vulnerable installations.
Instruct users to deny permission prompts when the displayed origin is unfamiliar, unusually long, or ends with an ellipsis.
Restrict access to permission-gated Web APIs through enterprise browser policies where those capabilities are not required.

bash

# Configuration example
# Firefox enterprise policy to disable geolocation and camera prompts on unmanaged sites
# /etc/firefox/policies/policies.json
{
  "policies": {
    "Permissions": {
      "Camera":      { "BlockNewRequests": true },
      "Microphone":  { "BlockNewRequests": true },
      "Location":    { "BlockNewRequests": true },
      "Notifications": { "BlockNewRequests": true }
    },
    "DisableAppUpdate": false
  }
}