CVE-2024-1549

What it actually does

A large custom cursor set by a website can visually overlap portions of a browser permission dialog, creating ambiguity that may cause a user to grant permissions they did not intend.

Why it matters to the business

Users may inadvertently grant camera, microphone, location, or other sensitive permissions, increasing risk of unauthorized access to personal data or device features across the user base.

How an attack unfolds

An attacker hosts a webpage that applies an oversized custom cursor positioned to intersect the permission prompt; when the browser displays the dialog the cursor overlaps the allow button, leading a confused user to click it and grant the requested permission.

How to fix it

Upgrade Firefox to version 123 or later, Firefox ESR to 115.8 or later, and Thunderbird to 115.8 or later. Apply updates through the browser's built-in update mechanism or package manager as soon as possible.

How to confirm the fix worked

Confirm the installed browser or Thunderbird version meets or exceeds the fixed releases listed above; re-test the affected permission prompts with a large custom cursor to verify the overlap no longer occurs.

Typical attack path

1. Victim visits attacker-controlled website
2. Page loads JavaScript that sets a large custom cursor
3. Browser renders a permission dialog that visually intersects the cursor
4. User clicks within the overlapped region, granting the permission
5. Attacker uses the newly granted permission for further actions such as recording or tracking

How to detect it

Review browser update logs and version inventories to identify any systems still running vulnerable releases; no reliable post-exploitation artifacts are produced by this UI-only issue.

What your security team should do

• Prioritize deployment of the fixed browser versions across all managed endpoints
• Communicate the update requirement to end users with clear instructions
• Monitor vendor release notes for any follow-on fixes in the same component
• Review internal policies for rapid browser update cadence