CVE-2024-1549: Mozilla Firefox UI Spoofing Vulnerability

CVE-2024-1549 Overview

CVE-2024-1549 is a user interface spoofing vulnerability affecting Mozilla Firefox, Firefox ESR, and Thunderbird. A website could specify a large custom cursor image whose visible portions overlap the browser's permission prompt dialog. The overlap obscures dialog text and buttons, misleading users into granting sensitive permissions such as camera, microphone, or geolocation access. The issue is tracked in Mozilla advisories MFSA-2024-05, MFSA-2024-06, and MFSA-2024-07, and Debian LTS has issued corresponding package updates. The flaw falls under the User Interface Confusion category and requires user interaction to trigger.

Critical Impact
Attackers can trick users into authorizing browser permissions they did not intend to grant, enabling access to privacy-sensitive device capabilities.

Affected Products

Mozilla Firefox versions prior to 123
Mozilla Firefox ESR versions prior to 115.8
Mozilla Thunderbird versions prior to 115.8 (also impacts Debian Linux 10 packages)

Discovery Timeline

2024-02-20 - CVE-2024-1549 published to the National Vulnerability Database
2024-02-20 - Mozilla publishes advisories MFSA-2024-05, MFSA-2024-06, and MFSA-2024-07 with fixes in Firefox 123, Firefox ESR 115.8, and Thunderbird 115.8
2024-03 - Debian LTS releases updated packages for affected distributions
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-1549

Vulnerability Analysis

The vulnerability stems from the browser's rendering of CSS custom cursors relative to native permission dialogs. Web content can define a cursor image using the CSS cursor: url(...) property. Firefox permitted cursor images large enough to extend beyond the standard cursor hotspot region and paint over browser chrome, including the permission prompt shown when a site requests access to camera, microphone, geolocation, or notifications. The visible cursor bitmap could cover explanatory text and even the Allow or Block buttons, presenting the user with a misleading UI state. This is a classic case of User Interface Confusion enabling clickjacking-style permission abuse. See Mozilla Bug Report #1833814 for full technical discussion.

Root Cause

The root cause is missing bounds enforcement between web-controlled cursor rendering and privileged browser UI surfaces. Firefox did not clip or suppress large custom cursor bitmaps when a permission prompt was displayed, allowing site-controlled pixels to overlay trusted chrome.

Attack Vector

An attacker hosts a malicious page that sets a very large custom cursor via CSS. The page then triggers a permission request through a Web API such as navigator.mediaDevices.getUserMedia() or navigator.geolocation.getCurrentPosition(). When Firefox renders the permission dialog, the oversized cursor overlaps portions of the prompt, positioning cursor pixels that mimic or hide dialog content near the Allow button. The user, unable to see the true dialog, clicks and unintentionally grants the requested permission. See the Mozilla Security Advisory MFSA-2024-05 for advisory-level details.

Detection Methods for CVE-2024-1549

Indicators of Compromise

Firefox, Firefox ESR, or Thunderbird process versions below 123, 115.8, and 115.8 respectively running on user endpoints.
Browser telemetry showing unexpected permission grants (camera, microphone, geolocation) shortly after visits to untrusted domains.
Web page resources referencing unusually large image files declared through CSS cursor: url(...) properties.

Detection Strategies

Inventory installed browser versions across the fleet and flag hosts running vulnerable Firefox or Thunderbird builds.
Review browser permissions.sqlite or the Firefox permissions database for recently granted origin-based permissions correlated with suspicious browsing activity.
Inspect web proxy or DNS logs for user visits to domains that subsequently request device permissions.

Monitoring Recommendations

Monitor endpoint software inventory feeds for Mozilla product versions and alert on installations below the patched builds.
Track outbound connections to known malicious domains that have historically hosted UI spoofing content.
Audit browser permission grants periodically and revoke unexpected camera, microphone, and geolocation authorizations.

How to Mitigate CVE-2024-1549

Immediate Actions Required

Upgrade Firefox to version 123 or later on all endpoints.
Upgrade Firefox ESR to version 115.8 or later where enterprise policy requires the extended support channel.
Upgrade Thunderbird to version 115.8 or later, including Debian package updates on Debian 10 systems.
Review and revoke any recently granted browser permissions that appear inconsistent with legitimate user activity.

Patch Information

Mozilla addressed the issue in Firefox 123, Firefox ESR 115.8, and Thunderbird 115.8. Refer to Mozilla Security Advisory MFSA-2024-05, MFSA-2024-06, and MFSA-2024-07. Debian users should apply the updates announced in the Debian LTS Announcement March 2024.

Workarounds

Deploy enterprise browser policy to disable or restrict site permission requests for camera, microphone, and geolocation on managed endpoints.
Use Firefox enterprise configuration to set permissions.default.camera, permissions.default.microphone, and permissions.default.geo to a blocked state until patches are deployed.
Educate users to decline permission prompts on unfamiliar sites and to close pages exhibiting anomalous cursor behavior.

bash

# Example Firefox enterprise policy (policies.json) to block sensitive permissions
{
  "policies": {
    "Permissions": {
      "Camera":     { "BlockNewRequests": true },
      "Microphone": { "BlockNewRequests": true },
      "Location":   { "BlockNewRequests": true },
      "Notifications": { "BlockNewRequests": true }
    }
  }
}