CVE-2023-6211

What it actually does

The flaw permits an attacker to bypass HTTPS-only mode protections by deceiving the user into granting an exception for an insecure HTTP page through a social engineering clicking game, resulting in the browser accepting mixed or downgraded content.

Why it matters to the business

Users may inadvertently expose browsing sessions to interception or tampering on insecure connections, increasing risk of data leaks, privacy violations, or compliance failures with minimal urgency due to low exploit maturity and no known ransomware use.

How an attack unfolds

An attacker hosts a malicious HTTP page and lures a target user who has HTTPS-only mode enabled; by embedding a clicking game that prompts for the exception grant, the attacker obtains the bypass and can then serve or redirect to insecure content.

How to fix it

Upgrade all instances of Mozilla Firefox to version 120 or later to restore proper HTTPS-only enforcement.

How to confirm the fix worked

Verify Firefox version is 120 or higher; test that HTTPS-only mode blocks HTTP loads without allowing user-granted exceptions via social engineering flows.

Typical attack path

1. Lure target to attacker-controlled HTTP page
2. Initiate interactive clicking game that requests HTTPS-only exception
3. Obtain user click to grant exception
4. Serve or redirect to insecure content for further attacks

How to detect it

Review browser history and logs for unexpected grants of HTTPS-only exceptions on HTTP origins; correlate with user reports of unusual page behavior or mixed-content warnings.

What your security team should do

• Prioritize updating Firefox deployments to 120+ across the environment
• Review and reinforce user training on recognizing deceptive web interactions
• Enable enterprise policies to lock down HTTPS-only exceptions where feasible