Improper Restriction of Rendered UI Layers or Frames in Firefox Focus for Android - CVE-2024-9391
Published: October 1, 2024
Vulnerability identifier: #VU97927
CSH Severity: Medium
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2024-9391
CWE-ID: CWE-1021
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to perform spoofing attack.
The vulnerability exists due to an error when exiting fullscreen mode. A user who enables full-screen mode on a specially crafted web page could potentially be prevented from exiting full screen mode. This may allow spoofing of other sites as the address bar is no longer visible.
Affected software
Firefox Focus for Android
Gentoo Linux
www-client/firefox
mail-client/thunderbird
mail-client/thunderbird-bin
dev-lang/spidermonkey
Gentoo Linux
www-client/firefox
mail-client/thunderbird
mail-client/thunderbird-bin
dev-lang/spidermonkey
How to mitigate CVE-2024-9391
Install updates from vendor's website.
Firefox Focus for Android - update to 131.0
www-client/firefox - update to 104
mail-client/thunderbird - update to 128.4.0
mail-client/thunderbird-bin - update to 128.4.0
dev-lang/spidermonkey - update to 128.8.0
www-client/firefox - update to 104
mail-client/thunderbird - update to 128.4.0
mail-client/thunderbird-bin - update to 128.4.0
dev-lang/spidermonkey - update to 128.8.0