CVE-2024-4768 Overview
CVE-2024-4768 is a user interface confusion vulnerability affecting Mozilla Firefox, Firefox Extended Support Release (ESR), and Thunderbird. The flaw resides in how popup notifications interact with the Web Authentication (WebAuthn) API. An attacker controlling a malicious web page can leverage the interaction to trick a user into granting sensitive permissions. The issue is classified under [CWE-281: Improper Preservation of Permissions] and requires user interaction over the network.
Critical Impact
Attackers can manipulate WebAuthn permission prompts to deceive users into approving actions they did not intend, undermining browser-based authentication trust boundaries.
Affected Products
- Mozilla Firefox versions prior to 126
- Mozilla Firefox ESR versions prior to 115.11
- Mozilla Thunderbird versions prior to 115.11 (and Debian Linux 10 packages)
Discovery Timeline
- 2024-05-14 - CVE-2024-4768 published to the National Vulnerability Database (NVD)
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-4768
Vulnerability Analysis
The vulnerability stems from improper handling of popup notifications when they overlap with WebAuthn permission requests. Firefox uses popup notifications to inform users about sensitive actions such as registering a security key or authenticating via a passkey. When a malicious site triggers a WebAuthn ceremony at the right moment, the notification chrome can be displayed in a way that reduces the clarity of what the user is approving. This category of issue is a social engineering enabler, sometimes referred to as UI redressing, because it exploits the user's trust in the browser's permission dialog. The impact is limited to actions the user can be persuaded to confirm, but WebAuthn approvals can be leveraged for account takeover on targeted origins.
Root Cause
The root cause is a timing and rendering interaction between Mozilla's popup notification framework and the WebAuthn permission prompt. Details are tracked in Mozilla Bug Report #1886082. Improper preservation of permission context [CWE-281] allowed one prompt to influence how the user perceived another.
Attack Vector
Exploitation requires the victim to visit an attacker-controlled web page in a vulnerable Firefox or Thunderbird build. The attacker orchestrates the timing of popup notifications and WebAuthn calls so that the user unintentionally confirms a WebAuthn operation. No prior authentication or elevated privileges are needed on the target system. The attack is delivered remotely and depends on user interaction with the crafted prompt.
No verified public proof-of-concept code is available for this issue. See the Mozilla Security Advisory MFSA-2024-21 and related advisories for vendor-authored technical details.
Detection Methods for CVE-2024-4768
Indicators of Compromise
- Unexpected WebAuthn registrations or authentications appearing on user accounts without a corresponding login event in identity provider logs.
- Browser telemetry showing WebAuthn ceremonies initiated from low-reputation or newly registered domains immediately after popup permission events.
- Endpoint records of Firefox or Thunderbird versions older than the fixed builds (Firefox 126, ESR 115.11, Thunderbird 115.11) still running in the environment.
Detection Strategies
- Inventory installed browser and mail client versions across managed endpoints and flag any build below the fixed versions.
- Correlate WebAuthn credential registration events from identity providers (Entra ID, Okta, Duo) against expected enrollment workflows to spot anomalies.
- Review browser crash and telemetry data for repeated popup notification sequences tied to unfamiliar origins.
Monitoring Recommendations
- Enable centralized logging of software inventory and forward Firefox and Thunderbird version data to your SIEM.
- Monitor authentication logs for new FIDO2 or passkey registrations, especially outside of provisioning windows.
- Track user-reported prompts that appear misleading or unexpected as part of phishing and social engineering intake.
How to Mitigate CVE-2024-4768
Immediate Actions Required
- Upgrade Firefox to version 126 or later on all endpoints.
- Upgrade Firefox ESR to 115.11 or later where extended support is required.
- Upgrade Thunderbird to 115.11 or later, including Debian Linux 10 packages patched under the Debian LTS Advisory.
- Audit recently registered WebAuthn credentials for suspicious enrollments and revoke any that cannot be attributed to a legitimate action.
Patch Information
Mozilla addressed the vulnerability in Firefox 126, Firefox ESR 115.11, and Thunderbird 115.11. Fix details are documented in Mozilla Security Advisory MFSA-2024-21, MFSA-2024-22, and MFSA-2024-23. Debian users should apply updates from the Debian LTS announcement.
Workarounds
- Restrict browsing to trusted sites through enterprise proxy or DNS filtering until patches are deployed.
- Train users to cancel WebAuthn prompts that appear during unrelated browsing activity and to report unexpected security key dialogs.
- Where feasible, enforce hardware security key attestation policies at the identity provider so that unauthorized credential registrations can be identified quickly.
# Verify Firefox version on Linux endpoints
firefox --version
# Debian/Ubuntu: apply vendor updates
sudo apt update && sudo apt install --only-upgrade firefox-esr thunderbird
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
