CVE-2024-10465

What it actually does

A clipboard paste button can persist across browser tabs, enabling spoofing of the paste action origin.

Why it matters to the business

Users may be tricked into pasting sensitive clipboard contents into untrusted sites, risking data exposure or unauthorized actions with moderate urgency due to public disclosure and low but rising exploit probability.

How an attack unfolds

An attacker hosts a malicious page that activates the persistent paste button, then redirects or tricks the user into another tab where the button appears legitimate, leading to spoofed paste operations; context from espionage and financially motivated campaigns noted in related Firefox issues.

How to fix it

Upgrade affected Firefox to version 132 or later, Firefox ESR to 128.4 or later, and Thunderbird to 128.4 or later; for listed qemu packages on Ubuntu 14.04 LTS apply the fixed version 2.0.0+dfsg-2ubuntu1.19 where applicable.

How to confirm the fix worked

Confirm browser and application versions meet or exceed the fixed releases; test tab switching behavior to verify the paste button no longer persists.

Typical attack path

1. Craft and host a page that triggers the persistent clipboard paste button
2. Lure the victim to interact with the button while switching tabs
3. Spoof the paste target to capture or misuse clipboard data

How to detect it

Review browser logs and process execution for unexpected tab or clipboard interactions; look for patterns associated with known exploitation campaigns targeting similar Firefox issues.

What your security team should do

• Prioritize patching Firefox, ESR, and Thunderbird instances within the next 30 days given public disclosure
• Monitor EPSS trend for any increase and review threat actor activity related to browser spoofing
• Communicate upgrade requirements to users and verify ecosystem prevalence of affected versions