CVE-2024-11692: Mozilla Firefox UI Spoofing Vulnerability

CVE-2024-11692 Overview

CVE-2024-11692 is a user interface spoofing vulnerability affecting Mozilla Firefox and Thunderbird. An attacker could cause a select dropdown element to render over another browser tab, creating visual confusion for users. This behavior enables spoofing attacks where dropdown content appears to originate from a trusted tab or page context.

The issue is classified under [CWE-290] (Authentication Bypass by Spoofing) and requires user interaction to exploit. Mozilla addressed the flaw in Firefox 133, Firefox ESR 128.5, Thunderbird 133, and Thunderbird 128.5.

Critical Impact
Attackers can render dropdown overlays across tab boundaries, enabling visual spoofing scenarios that may trick users into interacting with attacker-controlled content while believing it belongs to a trusted site.

Affected Products

Mozilla Firefox versions prior to 133
Mozilla Firefox ESR versions prior to 128.5
Mozilla Thunderbird versions prior to 133 and 128.5

Discovery Timeline

2024-11-26 - CVE-2024-11692 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-11692

Vulnerability Analysis

The flaw resides in how Firefox and Thunderbird render native select dropdown widgets. Under specific conditions, an attacker-controlled page can trigger a dropdown that visually extends beyond the boundaries of its originating tab. The dropdown can appear layered above content from another tab, breaking the visual isolation that browser users rely on for trust decisions.

Because dropdown widgets are drawn by the operating system's native windowing layer rather than as constrained HTML content, they can escape the browser's tab compositing surface. This behavior produces a mismatch between what the user sees and what the browser's security context actually represents.

Root Cause

The root cause is improper constraint of select element rendering to the origin tab's visible viewport. The dropdown widget's z-order and clipping region were not correctly bound to the active tab, allowing the popup surface to overlap adjacent browser chrome or content areas.

Attack Vector

Exploitation requires a victim to visit an attacker-controlled page and interact with a crafted select element. The attacker prepares a page that opens a select dropdown positioned so its rendered popup covers content in an adjacent tab or trusted UI region. A user glancing at the visible dropdown may attribute its contents to the wrong origin and take an action such as clicking a spoofed option.

Technical details are documented in Mozilla Bug Report #1909535 and the associated Mozilla Security Advisory MFSA-2024-63.

Detection Methods for CVE-2024-11692

Indicators of Compromise

Firefox or Thunderbird processes running at versions below 133 (or ESR below 128.5) after the patch release date
User reports of dropdown menus appearing in unexpected screen regions or persisting across tab switches
Browser telemetry showing unusual <select> element interactions on unfamiliar or newly registered domains

Detection Strategies

Inventory installed browser versions across the fleet and flag hosts running Firefox below 133 or Firefox ESR below 128.5
Monitor endpoint software inventory feeds for Thunderbird installations that have not received the 128.5 or 133 update
Review web proxy logs for user visits to low-reputation sites that coincide with credential-related help desk tickets

Monitoring Recommendations

Enable centralized browser version reporting through endpoint management tooling
Correlate phishing report submissions with browser version data to prioritize vulnerable hosts
Track Mozilla security advisory feeds (MFSA-2024-63, MFSA-2024-64, MFSA-2024-67, MFSA-2024-68) for related UI redressing issues

How to Mitigate CVE-2024-11692

Immediate Actions Required

Update Firefox to version 133 or later on all managed endpoints
Update Firefox ESR deployments to version 128.5 or later
Update Thunderbird installations to version 133 or the 128.5 ESR release
Apply Debian LTS packages referenced in the Debian LTS Announcement for affected distributions

Patch Information

Mozilla released fixes in Firefox 133, Firefox ESR 128.5, Thunderbird 133, and Thunderbird 128.5. Full technical context is available in Mozilla Security Advisory MFSA-2024-63 and the companion advisories MFSA-2024-64, MFSA-2024-67, and MFSA-2024-68. Downstream distributions such as Debian have published equivalent updates through their security channels.

Workarounds

Enforce automatic browser updates through group policy or configuration management to prevent version drift
Deliver targeted user awareness communications reminding staff to verify the active tab before entering credentials or clicking dropdown options
Restrict access to untrusted external sites from high-value workstations until patched browser versions are deployed

bash

# Verify installed Firefox version on Linux endpoints
firefox --version

# Verify Thunderbird version
thunderbird --version

# Debian/Ubuntu patch application
sudo apt update && sudo apt install --only-upgrade firefox-esr thunderbird