CVE-2024-6605: Mozilla Firefox Auth Bypass Vulnerability

CVE-2024-6605 Overview

CVE-2024-6605 affects Mozilla Firefox for Android versions prior to 128. The browser allowed immediate interaction with permission prompts, creating a tapjacking attack surface. An attacker can overlay deceptive UI elements above permission dialogs to trick users into granting sensitive permissions. The flaw maps to [CWE-277: Insecure Inherited Permissions] and falls under the User Interface Confusion category. Mozilla addressed the issue in Firefox 128 and documented it in security advisory MFSA-2024-29.

Critical Impact
Attackers can hijack user taps to grant sensitive Android permissions through deceptive UI overlays, leading to confidentiality, integrity, and availability impact.

Affected Products

Mozilla Firefox for Android versions earlier than 128
Mozilla Firefox mobile builds shipping the vulnerable permission prompt handler
Downstream Firefox-based Android browsers using affected Gecko releases

Discovery Timeline

2024-07-09 - CVE-2024-6605 published to NVD
2024-07-09 - Mozilla publishes security advisory MFSA-2024-29
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-6605

Vulnerability Analysis

The vulnerability resides in how Firefox for Android rendered and accepted input on permission prompts. The prompts accepted user interaction immediately upon display, without a delay window that would prevent tapjacking. Tapjacking is the Android equivalent of clickjacking, where a malicious overlay sits above a sensitive dialog and intercepts or masks the user's intent.

A malicious application or web context can present a benign-looking interface that aligns with the underlying permission prompt. When the user taps the visible overlay, the tap is delivered to the Firefox prompt, granting permissions such as camera, microphone, geolocation, or notifications. The browser provided no input throttle or focus check to detect that another window had recently obscured the prompt.

Root Cause

The root cause is missing tap-jacking mitigation on permission UI surfaces in the Firefox Android Fenix codebase. Android offers setFilterTouchesWhenObscured and view-level obscured-touch checks, which were not enforced on prompt views. The prompt also lacked a minimum display interval before accepting input.

Attack Vector

Exploitation requires user interaction but no privileges. A network-reachable web page or co-resident Android app can position an overlay using SYSTEM_ALERT_WINDOW or a toast-based technique while Firefox displays a permission request. The user perceives an unrelated UI element and taps through, unknowingly approving the underlying prompt. See the Mozilla Security Advisory MFSA-2024-29 and Mozilla Bug Report #1836786 for technical details.

Detection Methods for CVE-2024-6605

Indicators of Compromise

Firefox for Android installations reporting a version string below 128 in user-agent or about: telemetry
Unexpected granted permissions for sensitive APIs (camera, microphone, geolocation) tied to Firefox app data
Android apps requesting SYSTEM_ALERT_WINDOW or accessibility services alongside browser sessions

Detection Strategies

Inventory mobile endpoints and flag Firefox for Android builds earlier than 128 using MDM or UEM reporting
Audit Android permission grant logs for Firefox to identify prompts approved without corresponding user navigation events
Correlate installation of apps holding overlay or accessibility permissions with active Firefox sessions

Monitoring Recommendations

Track Firefox version drift across managed Android devices and alert on outdated installs
Monitor app installs that request overlay permissions on devices used for sensitive browsing
Review browser telemetry for anomalous permission acceptance rates on mobile fleets

How to Mitigate CVE-2024-6605

Immediate Actions Required

Update Mozilla Firefox for Android to version 128 or later on all managed and personal devices
Revoke overlay (SYSTEM_ALERT_WINDOW) and accessibility permissions from non-essential Android applications
Re-review and reset previously granted Firefox site permissions for camera, microphone, and location

Patch Information

Mozilla fixed the issue in Firefox 128. The fix enforces a delay and obscured-touch protection on Android permission prompts. Refer to the Mozilla Security Advisory MFSA-2024-29 for release notes and the upstream commit referenced in Mozilla Bug #1836786.

Workarounds

Restrict installation of Android apps that request overlay or accessibility services on corporate devices
Use a managed app configuration to deny permissions to Firefox until upgrade can be completed
Switch to a patched browser on Android until Firefox can be updated to 128 or later

bash

# Verify installed Firefox version on Android via adb
adb shell dumpsys package org.mozilla.firefox | grep versionName
# Expected output after patching: versionName=128.0 or higher