CVE-2024-7523: Mozilla Firefox Auth Bypass Vulnerability

CVE-2024-7523 Overview

CVE-2024-7523 affects Mozilla Firefox for Android in versions prior to 129. A <select> HTML element could partially obscure security prompts rendered by the browser. A malicious website could abuse this rendering behavior to trick users into granting sensitive permissions such as geolocation, camera, or microphone access. The issue is a user interface (UI) redress flaw classified under [CWE-1021: Improper Restriction of Rendered UI Layers or Frames]. Mozilla addressed the issue in Firefox 129 through the MFSA-2024-33 advisory.

Critical Impact
Attackers hosting a malicious page can obscure Firefox for Android permission prompts and trick users into granting access to sensitive device capabilities.

Affected Products

Mozilla Firefox for Android versions earlier than 129
Firefox mobile builds distributed through Google Play prior to the 129 release
Downstream Firefox for Android forks that had not merged the upstream fix at the time of publication

Discovery Timeline

2024-08-06 - CVE-2024-7523 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-7523

Vulnerability Analysis

The vulnerability is a UI spoofing issue specific to the Android build of Firefox. When a page renders an HTML <select> element and expands its option list, the resulting dropdown can visually overlap with browser-rendered security prompts. Because the dropdown is drawn on top of, or beside, the prompt, users cannot read the full text of the permission request they are approving.

An attacker can time the dropdown expansion to coincide with a permission request triggered from JavaScript. The user sees a truncated or obscured prompt and taps an affirmative option, effectively granting access to sensitive APIs. The classification under [CWE-1021] reflects the failure to isolate trusted browser UI from untrusted page content.

Root Cause

Firefox for Android renders native <select> option lists using a layer that is not consistently placed below trusted browser chrome. Security prompts for permissions such as geolocation, notifications, camera, or microphone can therefore be partially covered by page-controlled UI. Mozilla tracked the underlying defect in Bugzilla bug 1908344.

Attack Vector

Exploitation requires the user to visit an attacker-controlled or compromised website on Firefox for Android. The malicious page opens a <select> element and simultaneously calls a Web API that generates a permission prompt. The dropdown obscures parts of the prompt while leaving action buttons reachable, encouraging the user to tap Allow. No authentication or elevated privileges are needed on the client side.

No public proof-of-concept exploit or exploit database entry has been published for this issue. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2024-7523

Indicators of Compromise

Firefox for Android build reporting a version string below 129 in the User-Agent header or about: pages.
Unexpected permission grants for geolocation, camera, microphone, or notifications recorded in Firefox site permissions on managed devices.
Web content that programmatically opens a <select> element within the same user gesture that requests a sensitive permission.

Detection Strategies

Inventory mobile browsers on managed Android devices and flag Firefox installations older than 129.
Review mobile device management (MDM) telemetry for permission changes on high-risk apps and correlate with browsing history where available.
Inspect suspicious pages for JavaScript that combines HTMLSelectElement interaction with calls to navigator.geolocation, navigator.mediaDevices.getUserMedia, or the Notifications API.

Monitoring Recommendations

Alert on outbound connections from mobile endpoints to domains recently associated with UI redress or clickjacking campaigns.
Track Firefox for Android version reporting through web analytics or MDM compliance dashboards.
Monitor user-reported incidents of misleading prompts and route them to the security team for triage.

How to Mitigate CVE-2024-7523

Immediate Actions Required

Update Firefox for Android to version 129 or later through Google Play or the Mozilla APK channel.
Enforce a minimum browser version policy on managed mobile devices through MDM.
Instruct users to deny permission prompts they cannot fully read and to reload the page before responding.

Patch Information

Mozilla fixed CVE-2024-7523 in Firefox 129 for Android. The full list of issues resolved in that release is documented in Mozilla Security Advisory MFSA-2024-33. Technical details are tracked in Mozilla Bug 1908344.

Workarounds

Restrict browsing on affected devices to trusted sites until the update is deployed.
Revoke previously granted site permissions in Firefox settings under Site permissions and re-evaluate each site.
Use an alternate, patched mobile browser for high-sensitivity workflows if the Firefox update cannot be applied immediately.

bash

# Example MDM compliance check for Firefox for Android version
adb shell dumpsys package org.mozilla.firefox | grep versionName
# Expected output for patched devices:
# versionName=129.0 (or later)