CVE-2024-0748

What it actually does

A compromised content process can update the document URI, enabling an attacker to set an arbitrary URI in the address bar or browser history.

Why it matters to the business

Users may be misled about the site they are visiting, increasing risk of phishing or other social engineering attacks that erode trust in the browser.

How an attack unfolds

An attacker compromises a content process in an affected Firefox version and then manipulates the document URI to display a spoofed address in the address bar or history.

How to fix it

Upgrade Mozilla Firefox to version 122 or later to address the improper input validation in content processes.

How to confirm the fix worked

Verify the installed Firefox version is 122 or higher and test address bar behavior with crafted content process scenarios in a lab environment.

Typical attack path

1. Compromise a content process within Firefox
2. Use the compromised process to update the document URI to an attacker-controlled value
3. Observe the spoofed URI displayed in the address bar or stored in history

How to detect it

Examine browser process logs and history entries for unexpected URI modifications originating from content processes, though specific artifacts are limited without active exploitation.

What your security team should do

• Update all Firefox deployments to version 122 or newer as soon as possible
• Enforce browser update policies across the organization
• Monitor threat intelligence for any increase in exploitation attempts against this family of issues