CVE-2024-4776: Mozilla Firefox XSS Vulnerability

CVE-2024-4776 Overview

CVE-2024-4776 affects Mozilla Firefox versions prior to 126. The vulnerability stems from improper handling of file dialogs displayed while the browser is in full-screen mode. When a file dialog is shown during full-screen, the underlying window can remain disabled, creating a user interface confusion condition that an attacker-controlled page can leverage.

Mozilla published the issue in security advisory MFSA-2024-21. The flaw is tracked under [CWE-79] and requires user interaction over a network attack vector. Mozilla addressed the issue in Firefox 126.

Critical Impact
Attackers can exploit the disabled window state to facilitate spoofing or denial-of-service conditions against the browser session, undermining user trust in dialog-driven security decisions.

Affected Products

Mozilla Firefox versions prior to 126

Discovery Timeline

2024-05-14 - CVE-2024-4776 published to NVD
2024-05-14 - Mozilla publishes security advisory MFSA-2024-21
2025-04-01 - Last updated in NVD database

Technical Details for CVE-2024-4776

Vulnerability Analysis

The vulnerability resides in how Firefox manages window state transitions between full-screen mode and modal file dialog presentation. When a web page triggers a file dialog while the browser is in full-screen, the parent window can be left in a disabled state after the dialog interaction completes.

This disabled state breaks the expected user interface contract. Users may be unable to interact with the browser window, or the window may render in an inconsistent state that hides security-relevant indicators such as the address bar or permission prompts.

The issue is classified under [CWE-79], reflecting a cross-site scripting context where attacker-controlled content drives the dialog invocation. The flaw requires user interaction to trigger.

Root Cause

The root cause involves improper synchronization between the full-screen window state machine and the modal dialog subsystem. Firefox did not correctly re-enable the parent window after the file dialog returned, leaving the chrome window in a disabled state.

Attack Vector

An attacker hosts a malicious web page that requests full-screen mode and subsequently invokes a file picker dialog through standard web APIs such as <input type="file">. After the user interacts with the dialog, the browser window remains disabled, enabling the attacker to maintain a deceptive visual state. The vulnerability requires user interaction and is exploitable over the network.

The vulnerability is described in prose only. See the Mozilla Security Advisory MFSA-2024-21 and Mozilla Bug Report #1887343 for additional technical context.

Detection Methods for CVE-2024-4776

Indicators of Compromise

Firefox client versions below 126 reporting unresponsive window states after file upload prompts on untrusted web pages.
Web pages combining requestFullscreen() API calls with rapid file input element activation in browser telemetry.
User reports of frozen browser chrome immediately following file picker interactions on attacker-controlled sites.

Detection Strategies

Inventory endpoints to identify Firefox installations on versions prior to 126 using software asset management tools.
Monitor browser process telemetry for hung-window patterns correlated with web navigation events.
Review proxy and DNS logs for connections to domains hosting suspicious full-screen experiences targeting Firefox users.

Monitoring Recommendations

Track Firefox version compliance across managed endpoints and flag systems running versions below 126.
Alert on unusual file dialog activity patterns originating from browser child processes.
Correlate user-reported browser hangs with recent web browsing telemetry to surface potential exploitation attempts.

How to Mitigate CVE-2024-4776

Immediate Actions Required

Update Mozilla Firefox to version 126 or later on all managed endpoints without delay.
Enable automatic updates for Firefox to ensure timely deployment of future security releases.
Distribute user guidance warning against interacting with file dialogs on untrusted full-screen web pages.

Patch Information

Mozilla released the fix in Firefox 126. Administrators should consult the Mozilla Security Advisory MFSA-2024-21 for the complete list of addressed issues and deployment guidance. The underlying defect is documented in Mozilla Bug Report #1887343.

Workarounds

Restrict full-screen API usage through enterprise browser policy where business requirements permit.
Train users to exit full-screen mode using the Esc key before interacting with file dialogs on unfamiliar sites.
Deploy browser configuration management to block known malicious domains attempting to abuse full-screen transitions.

bash

# Configuration example - verify Firefox version compliance on Linux endpoints
firefox --version
# Expected output: Mozilla Firefox 126.0 or later