CVE-2024-0749

What it actually does

The vulnerability allows a malicious website to open an about: dialog that displays attacker-controlled content while showing an incorrect origin in the address bar, bypassing expected origin validation for the displayed content.

Why it matters to the business

Users may be tricked into disclosing credentials or performing actions on what appears to be a legitimate site, increasing successful phishing success rates and potential data exposure across browser users.

How an attack unfolds

An attacker hosts a phishing page that triggers an about: dialog via crafted navigation; the dialog renders attacker content but displays a spoofed origin, leading the victim to trust and interact with the content as if it came from the claimed legitimate source.

How to fix it

Upgrade Mozilla Firefox to version 122 or later and Mozilla Thunderbird to version 115.7 or later. Apply updates through official channels for all affected installations including ESR variants and downstream distributions.

How to confirm the fix worked

Verify browser and email client versions meet or exceed the fixed releases; test that about: dialogs correctly reflect origins on known test cases and confirm no spoofing is possible post-update.

Typical attack path

1. Victim visits attacker-controlled phishing page
2. Page triggers about: dialog with spoofed origin display
3. Victim interacts with dialog content believing it is from a trusted origin
4. Attacker captures credentials or executes social engineering actions

How to detect it

Review browser process logs, extension activity, and network requests for unexpected about: protocol usage originating from untrusted domains; check for post-exploitation indicators such as unusual credential submission patterns following about: dialog interactions.

What your security team should do

• Prioritize deployment of Firefox 122+ and Thunderbird 115.7+ across all managed endpoints
• Monitor for delayed patching in high-risk user populations
• Reinforce user awareness training on address bar verification as a compensating control