CVE-2024-1550

What it actually does

A malicious site can combine exiting fullscreen mode with requestPointerLock to unexpectedly reposition the mouse cursor, creating user confusion that leads to inadvertent permission grants.

Why it matters to the business

Users on affected browsers may grant permissions they did not intend, increasing the chance of follow-on social-engineering or malware incidents; the flaw has been public for over two years with no observed mass exploitation.

How an attack unfolds

An attacker hosts a malicious page that triggers fullscreen exit followed immediately by a pointer-lock request; the resulting cursor jump can trick the user into clicking a permission dialog they did not expect, granting camera, microphone, or location access.

How to fix it

Upgrade Firefox to 123 or later, Firefox ESR to 115.8 or later, and Thunderbird to 115.8 or later; apply updates through the browser's built-in updater or enterprise distribution channels.

How to confirm the fix worked

Confirm the browser reports version 123+, 115.8+, or 115.8+ respectively after update; test that fullscreen exit no longer allows pointer-lock to move the cursor outside the expected window bounds.

Typical attack path

1. Victim visits attacker-controlled website
2. Page enters and then exits fullscreen mode
3. requestPointerLock is invoked to reposition the cursor
4. User is presented with a permission prompt at an unexpected screen location
5. User inadvertently clicks Allow, granting sensitive permissions

How to detect it

Review browser security and permission logs for unexpected grants of camera, microphone, or location access immediately after fullscreen activity; correlate with web-request logs to attacker-controlled domains.

What your security team should do

• Prioritize browser updates for all managed endpoints within the next patching cycle
• Enable automatic updates where policy permits
• Educate users on recognizing unexpected permission prompts
• Monitor vendor advisories for any future related pointer-lock or fullscreen changes