CVE-2024-0750

What it actually does

A timing flaw in popup notification delay calculation allows an attacker-controlled page to suppress or accelerate permission prompts, causing the browser to grant permissions (such as camera, microphone, or location) without the user realizing they have approved the request.

Why it matters to the business

Attackers can obtain persistent access to sensitive device features and user data across large browser deployments, increasing the risk of surveillance, data exfiltration, and further compromise without requiring additional user interaction.

How an attack unfolds

An attacker hosts a malicious site that opens a popup at a carefully chosen moment; due to the incorrect delay calculation the permission dialog appears or disappears in a way that leads the user to click allow, after which the granted permission persists for the origin.

How to fix it

Upgrade Firefox to version 122 or later, Firefox ESR to 115.7 or later, and Thunderbird to 115.7 or later. Where immediate patching is not possible, disable unnecessary permission prompts via enterprise policy and restrict JavaScript popups.

How to confirm the fix worked

Confirm browser versions meet or exceed the fixed releases listed above; test that permission prompts now respect the intended delay and cannot be manipulated by rapid popup creation from untrusted origins.

Typical attack path

1. Lure victim to attacker-controlled web page via phishing or malicious advertisement
2. Page opens popup window with permission request for sensitive capability
3. Exploit incorrect delay calculation to manipulate prompt timing or visibility
4. User is tricked into granting the permission
5. Attacker origin now holds elevated browser privileges for future sessions

How to detect it

Review browser permission logs and history for unexpected grants to unknown origins; examine web server access logs for visits to domains that trigger rapid popup sequences; correlate with user reports of unusual permission dialogs.

What your security team should do

• Prioritize patching all Firefox, ESR, and Thunderbird instances to the fixed versions
• Enable automatic updates for browser packages across the fleet
• Review enterprise policies that allow JavaScript popups and tighten where feasible
• Monitor vulnerability disclosure feeds for any change in exploit maturity