CVE-2024-10465: Mozilla Firefox Clipboard Spoofing Vulnerability

CVE-2024-10465 Overview

CVE-2024-10465 is a spoofing vulnerability affecting Mozilla Firefox, Firefox ESR, and Thunderbird. The flaw allows a clipboard paste button to persist across browser tabs. An attacker controlling a malicious page can leverage this persistence to trick users into pasting clipboard contents into an unintended origin. The issue is classified as an authentication spoofing weakness under [CWE-290].

Mozilla patched the vulnerability in Firefox 132, Firefox ESR 128.4, Thunderbird 128.4, and Thunderbird 132. The vulnerability requires user interaction and does not directly disclose data confidentiality, but integrity impact is high because attacker-controlled UI elements can influence user actions.

Critical Impact
An attacker can exploit persistent clipboard UI to spoof origin context and cause victims to paste sensitive clipboard contents into an attacker-controlled tab.

Affected Products

Mozilla Firefox versions prior to 132
Mozilla Firefox ESR versions prior to 128.4
Mozilla Thunderbird versions prior to 128.4 and prior to 132

Discovery Timeline

2024-10-29 - CVE-2024-10465 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-10465

Vulnerability Analysis

The vulnerability resides in Firefox's clipboard permission UI. Firefox displays a paste button when a page invokes the Async Clipboard API (navigator.clipboard.readText() or read()) to request clipboard access. This button is intended to be scoped to the requesting origin and dismissed when the user navigates away or switches tabs.

Due to improper UI lifecycle handling, the paste button could persist across tab switches. A malicious page requesting clipboard access could keep the prompt active while the user navigated to a different, trusted tab. The user, believing the prompt belonged to the new tab, could then click paste, delivering clipboard contents to the original attacker-controlled origin.

Root Cause

The root cause is a state-management flaw in the clipboard permission prompt lifecycle. The UI element was not properly bound to the tab or document that initiated the request. Instead of being dismissed on tab change, the prompt continued to be rendered, allowing origin confusion. This maps to [CWE-290] (Authentication Bypass by Spoofing), because the visible security context did not match the origin receiving the pasted data.

Attack Vector

Exploitation requires user interaction and a victim visiting an attacker-controlled page. The attacker page calls the clipboard read API to trigger the paste button. The user then switches tabs, and the prompt persists. When the user interacts with the persistent button in the context of another tab, clipboard contents are delivered to the original malicious origin. Sensitive data commonly held on the clipboard, such as passwords copied from password managers, one-time codes, or wallet addresses, can be exfiltrated through this flow.

No verified proof-of-concept code is publicly available. Refer to Mozilla Bug Report #1918853 for technical details.

Detection Methods for CVE-2024-10465

Indicators of Compromise

Firefox or Thunderbird processes below the patched versions (< 132, ESR < 128.4) observed in endpoint inventory
Outbound HTTP/HTTPS requests to untrusted origins containing form data or POST bodies that match recently copied clipboard content
Browser telemetry showing repeated calls to navigator.clipboard.readText from low-reputation domains

Detection Strategies

Inventory installed browser versions across managed endpoints and flag Firefox and Thunderbird builds that predate the fix.
Monitor web proxy or DNS logs for user visits to newly registered or low-reputation domains that immediately request clipboard permissions.
Correlate password-manager copy events with subsequent outbound requests to domains other than the site the credential belongs to.

Monitoring Recommendations

Enable browser update compliance reporting through your endpoint management platform.
Log Content Security Policy (CSP) violation reports and permission-prompt events where available via enterprise browser policies.
Review credential-theft alerts and phishing telemetry for patterns consistent with clipboard-based data collection.

How to Mitigate CVE-2024-10465

Immediate Actions Required

Update Firefox to version 132 or later on all managed endpoints.
Update Firefox ESR to 128.4 or later where ESR is the deployed channel.
Update Thunderbird to 128.4 or 132 or later.
Restart browser and mail client processes after patch deployment to ensure the vulnerable code path is unloaded.

Patch Information

Mozilla addressed CVE-2024-10465 in the October 2024 security releases. Full remediation details are available in Mozilla Security Advisory MFSA-2024-55, MFSA-2024-56, MFSA-2024-58, and MFSA-2024-59. Distribution-level updates are documented in the Debian LTS Announcement October 2024 and November 2024.

Workarounds

Deploy enterprise policy to deny the clipboard-read permission by default via the Permissions policy in Firefox enterprise configuration.
Educate users to avoid clicking clipboard paste prompts after switching tabs and to close attacker-suspected tabs before pasting sensitive data.
Restrict Firefox and Thunderbird installations to the current release or ESR channels tracked by your patch management program.

bash

# Firefox enterprise policy example: block clipboard read by default
# Save as policies.json in the Firefox distribution directory
{
  "policies": {
    "Permissions": {
      "Clipboard": {
        "BlockedForUrls": ["<all_urls>"],
        "Default": "block"
      }
    },
    "DisableAppUpdate": false
  }
}