CVE-2024-1548: Mozilla Firefox Fullscreen Spoofing Flaw

CVE-2024-1548 Overview

CVE-2024-1548 is a user interface spoofing vulnerability affecting Mozilla Firefox, Firefox Extended Support Release (ESR), and Thunderbird. A malicious website could obscure the browser's fullscreen notification banner by rendering a dropdown <select> input element over it. This weakened a security indicator that warns users when a page enters fullscreen mode, opening the door to spoofing attacks such as fake login prompts or address bar impersonation. The issue affects Firefox before version 123, Firefox ESR before 115.8, and Thunderbird before 115.8. Mozilla addressed the flaw in security advisories MFSA-2024-05, MFSA-2024-06, and MFSA-2024-07.

Critical Impact
Attackers can obscure the fullscreen warning to convince users they are interacting with the operating system or a trusted site, enabling credential phishing and interface spoofing.

Affected Products

Mozilla Firefox versions prior to 123
Mozilla Firefox ESR versions prior to 115.8
Mozilla Thunderbird versions prior to 115.8 (and Debian Linux 10 packages shipping the affected builds)

Discovery Timeline

2024-02-20 - CVE-2024-1548 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-1548

Vulnerability Analysis

The vulnerability is a user interface (UI) spoofing weakness in the fullscreen transition flow. When a webpage requests fullscreen mode through the Fullscreen API, Firefox displays a transient notification informing the user that the page has taken over the screen. This notification is a critical security indicator because it prevents pages from imitating operating system dialogs or browser chrome. The flaw allowed a webpage to layer a native HTML <select> dropdown on top of the notification, hiding it from view. Because dropdown popup widgets are rendered by the operating system's native controls, they can appear above browser-rendered overlays and escape the browser's z-order guarantees. Refer to Mozilla Bug 1832627 for tracking details.

Root Cause

The root cause is inadequate z-order and event-layering enforcement between browser chrome notifications and OS-native form control popups. The fullscreen notification could be visually occluded by content rendered outside the standard DOM stacking context, defeating the assumption that the warning is always visible to the user.

Attack Vector

Exploitation requires user interaction: the victim must visit a malicious page and either grant fullscreen permission or interact with the crafted <select> element. Once fullscreen is active and the notification is hidden, the attacker can render arbitrary content that mimics the browser address bar, a system authentication prompt, or a trusted site login form to harvest credentials or trick the user into performing sensitive actions.

No verified public proof-of-concept code is available for this issue. Technical detail is documented in the linked Mozilla Bugzilla entry.

Detection Methods for CVE-2024-1548

Indicators of Compromise

Browser telemetry showing web pages that programmatically call element.requestFullscreen() immediately followed by focus events on a <select> element.
User reports of unexpected fullscreen transitions, fake browser chrome, or credential prompts that do not match the browsing context.
Web proxy logs showing repeated visits to previously unseen domains that host phishing kits or credential capture forms.

Detection Strategies

Inventory endpoints for Firefox, Firefox ESR, and Thunderbird versions below the patched releases and prioritize them for updates.
Monitor HTTP response bodies at the web gateway for pages combining Fullscreen API calls with overlay UI patterns targeting Firefox users.
Correlate phishing report tickets with browser version to identify unpatched clients that may have been exploited.

Monitoring Recommendations

Enable enterprise browser telemetry and forward events to a centralized log platform for detection engineering.
Track user-agent strings across authentication logs to flag sessions originating from vulnerable Firefox builds.
Alert on newly registered or low-reputation domains delivering pages that invoke fullscreen mode without a clear content reason.

How to Mitigate CVE-2024-1548

Immediate Actions Required

Upgrade Firefox to version 123 or later on all managed endpoints.
Upgrade Firefox ESR to 115.8 or later where extended support builds are in use.
Upgrade Thunderbird to 115.8 or later, including Debian Linux packages tracked in the Debian LTS March 2024 announcement.
Communicate phishing awareness guidance to users, emphasizing skepticism toward unexpected fullscreen transitions.

Patch Information

Mozilla released fixes in Firefox 123, Firefox ESR 115.8, and Thunderbird 115.8. Full details are available in Mozilla Security Advisory MFSA-2024-05, MFSA-2024-06, and MFSA-2024-07. Debian users should install the updated packages published through the Debian LTS advisory channel.

Workarounds

Disable the Fullscreen API through enterprise policy by setting full-screen-api.enabled to false in about:config or via a managed policy file until patches are applied.
Deploy browser management policies that restrict fullscreen prompts to allowlisted domains.
Train users to press the Esc key when unexpected fullscreen behavior occurs and to verify browser chrome by exiting fullscreen before entering credentials.

bash

# Firefox enterprise policy example (policies.json) to disable the Fullscreen API
{
  "policies": {
    "Preferences": {
      "full-screen-api.enabled": {
        "Value": false,
        "Status": "locked"
      }
    }
  }
}