CVE-2024-2609

What it actually does

A permission prompt's input delay timer expires even when the browser window lacks focus, enabling clickjacking overlays on malicious sites to grant permissions without user intent.

Why it matters to the business

Attackers may obtain unauthorized access to device features such as camera, microphone, or location, resulting in privacy violations, data exposure, and compliance risks across browser deployments.

How an attack unfolds

An attacker crafts a malicious website that initiates a permission request; while the target window is unfocused the delay expires, allowing clickjacking to deceive the user into approving the prompt.

How to fix it

Upgrade Firefox to 124 or later, Firefox ESR to 115.10 or later, and Thunderbird to 115.10 or later. For listed packages apply blivet-data (AlmaLinux:8) fixed in 1:3.4.0-9.el8 and python3-blivet (AlmaLinux:8) fixed in 1:3.4.0-9.el8.

How to confirm the fix worked

Verify installed browser and package versions against the fixed releases; inspect about:config or equivalent for prompt delay behavior if configurable.

Typical attack path

1. Lure user to attacker-controlled website via phishing or malvertising
2. Trigger permission prompt for sensitive capability
3. Ensure browser window loses focus so delay expires
4. Overlay clickjacking UI to capture user click on allow action
5. Obtain granted permission for ongoing abuse

How to detect it

Review browser permission logs and history for unexpected grants from unknown origins; correlate with web proxy or endpoint logs showing visits to suspicious domains shortly before permission changes.

What your security team should do

• Prioritize browser updates on all endpoints given widespread use
• Monitor for unusual permission grants in browser telemetry
• Educate users on recognizing unexpected permission prompts
• Apply package updates via system package manager where listed