CVE-2021-43546

What it actually does

The flaw permits an attacker to recreate cursor spoofing attacks when a user has enabled a zoomed native cursor, allowing visual deception of the pointer position or appearance through improper input validation in rendering.

Why it matters to the business

Users on unpatched systems may be tricked into unintended clicks or actions, increasing phishing success rates and potential data exposure or unauthorized operations across widely deployed browser and email clients.

How an attack unfolds

An attacker hosts a malicious webpage or email that triggers the cursor rendering issue under zoom; when the victim views it with a zoomed native cursor enabled, the spoofed cursor misleads the user into interacting with hidden or fake elements, achieving clickjacking or similar deception without needing elevated privileges.

How to fix it

Upgrade Mozilla Firefox to version 95 or later, Firefox ESR to 91.4.0 or later, and Thunderbird to 91.4.0 or later. Apply vendor patches immediately given the 1779 days since publication and slight EPSS increase; for Debian systems, use distribution-specific backports once available.

How to confirm the fix worked

Verify installed versions meet or exceed Firefox 95, ESR 91.4.0, and Thunderbird 91.4.0; test cursor rendering behavior with zoom enabled on sample pages that previously triggered spoofing; confirm absence of the improper input validation in updated rendering code.

Typical attack path

1. Attacker crafts and hosts a malicious webpage exploiting the cursor zoom rendering path.
2. Victim with zoomed native cursor enabled visits the page via Firefox, ESR, or Thunderbird.
3. Spoofed cursor deceives the user into clicking on attacker-controlled UI elements.
4. User performs unintended action such as confirming a download or submitting credentials.
5. Attacker achieves goal of social engineering or unauthorized interaction.

How to detect it

Review browser and application logs for unexpected navigation or click events originating from untrusted domains; inspect user reports of anomalous cursor behavior; correlate with web proxy or email logs showing visits to suspicious sites around the time of reported issues. No specific post-exploitation artifacts are typically left on disk.

What your security team should do

• Prioritize patching all Firefox, ESR, and Thunderbird instances to the fixed versions within the next maintenance window due to public exploit details and EPSS trend.
• Audit enterprise browser and email client deployments for affected versions and enforce automatic updates where possible.
• Educate users on risks of cursor anomalies during browsing and encourage reporting of suspicious pointer behavior.
• Monitor vendor advisories for any downstream Debian package updates.