CVE-2024-6607: Mozilla Firefox UI Spoofing Vulnerability

CVE-2024-6607 Overview

CVE-2024-6607 is a user interface spoofing vulnerability affecting Mozilla Firefox and Mozilla Thunderbird versions prior to 128. The flaw allows a malicious site to prevent a user from exiting pointerlock when pressing the Escape key. It also permits customValidity notifications from a <select> element to overlay certain permission prompts. Attackers can chain these behaviors to confuse users into granting unintended permissions to a hostile origin. The issue is classified under [CWE-763] and falls into the category of User Interface Confusion vulnerabilities.

Critical Impact
A remote site can trap pointer input and overlay validation messages on permission dialogs, tricking users into approving sensitive browser permissions such as camera, microphone, or location access.

Affected Products

Mozilla Firefox versions prior to 128
Mozilla Thunderbird versions prior to 128
Platforms running affected Mozilla browser engines (Gecko)

Discovery Timeline

2024-07-09 - CVE-2024-6607 published to NVD
2025-07-16 - Last updated in NVD database

Technical Details for CVE-2024-6607

Vulnerability Analysis

The vulnerability combines two distinct UI flaws in the Gecko rendering engine. The first defect lets a web page retain pointerlock even after the user presses Escape, which is the standard browser-enforced exit mechanism. The second defect allows customValidity validation bubbles, rendered from an HTML <select> element, to be painted on top of browser-chrome permission prompts.

When combined, an attacker can hide the true content of a permission prompt behind attacker-controlled text while denying the user the normal means of regaining cursor control. The user, believing they are interacting with a different message, clicks a button that actually grants a site permission such as camera access, microphone access, geolocation, or notifications. The vulnerability requires user interaction but no privileges or special access.

Root Cause

The root cause is improper transfer of resources between control spheres [CWE-763]. The browser fails to enforce that privileged UI surfaces, specifically permission prompts, remain non-occludable by web content. It also fails to guarantee that the Escape key always releases pointer lock, breaking a documented user-safety invariant of the Pointer Lock API.

Attack Vector

Exploitation begins when a victim visits an attacker-controlled web page. The page requests pointerlock and registers a <select> element with a crafted customValidity string. The site then triggers a browser permission prompt and positions the validation bubble over the prompt, masking the real action being requested. The user, unable to release the cursor with Escape, clicks the prompt and unknowingly grants the permission. Refer to the Mozilla Security Advisory MFSA-2024-29 and Mozilla Bug Report #1694513 for technical specifics.

Detection Methods for CVE-2024-6607

Indicators of Compromise

Browser sessions that became unresponsive to the Escape key while pointer lock was active on an untrusted page.
Unexpected entries in site permissions for camera, microphone, geolocation, or notifications granted to unfamiliar origins.
Outbound connections from endpoints to domains that hosted full-screen or pointer-locked content immediately before suspicious permission grants.

Detection Strategies

Inventory Firefox and Thunderbird versions across managed endpoints and flag any installation reporting a version below 128.
Monitor browser telemetry and proxy logs for repeated calls to requestPointerLock() followed by permission prompt activity on the same origin.
Review enterprise browser policies for sites that have been granted sensitive permissions and correlate against user-reported UI anomalies.

Monitoring Recommendations

Enable centralized logging of browser version inventory through endpoint management tooling and alert on out-of-date Mozilla products.
Track DNS and web proxy traffic to newly registered domains that load full-screen or pointer-lock content as part of social engineering campaigns.
Encourage users to report any case where the Escape key fails to release the cursor, and triage these reports as potential exploitation attempts.

How to Mitigate CVE-2024-6607

Immediate Actions Required

Upgrade Mozilla Firefox to version 128 or later on every managed endpoint.
Upgrade Mozilla Thunderbird to version 128 or later on every managed endpoint.
Audit currently granted site permissions and revoke access for any origin that cannot be justified.
Distribute user guidance warning against approving permission prompts that appear alongside unexpected validation bubbles or locked cursors.

Patch Information

Mozilla addressed the issue in Firefox 128 and Thunderbird 128. Patch details are published in Mozilla Security Advisory MFSA-2024-29 and Mozilla Security Advisory MFSA-2024-32. Administrators should deploy these updates through standard software distribution channels and verify versions post-deployment.

Workarounds

Disable the Pointer Lock API via enterprise policy by setting dom.pointer-lock.enabled to false in about:config or through a managed policy file until patches are applied.
Restrict permission prompts using the Firefox Enterprise Policy Permissions block to deny camera, microphone, and location requests by default.
Use enterprise browser hardening to disallow untrusted sites from entering full-screen or pointer-lock states.

bash

# Example Firefox enterprise policy (policies.json) to harden permissions
{
  "policies": {
    "Permissions": {
      "Camera":     { "BlockNewRequests": true, "Locked": true },
      "Microphone": { "BlockNewRequests": true, "Locked": true },
      "Location":   { "BlockNewRequests": true, "Locked": true },
      "Notifications": { "BlockNewRequests": true, "Locked": true }
    },
    "Preferences": {
      "dom.pointer-lock.enabled": { "Value": false, "Status": "locked" }
    }
  }
}