CVE-2024-2611

What it actually does

Missing delay before pointer lock activation allows a malicious page to obtain pointer lock permissions without sufficient user awareness or intent confirmation, bypassing normal authorization checks for input device control.

Why it matters to the business

Enables potential deception of users into granting input control to attacker-controlled pages, increasing risk of phishing or session manipulation in browser and email clients; low EPSS and lack of KEV listing indicate limited observed exploitation but still requires prompt patching across Firefox and Thunderbird deployments.

How an attack unfolds

An attacker creates a webpage that immediately requests pointer lock without the required delay, tricking the user during normal browsing into granting the permission, after which the page can capture or simulate mouse and keyboard input for further malicious actions.

How to fix it

Upgrade Firefox to version 124 or later, Firefox ESR to 115.9 or later, and Thunderbird to 115.9 or later. On AlmaLinux 8 systems also apply the listed package updates: rpm-ostree and rpm-ostree-libs to 2022.2-2.el8.alma, and ostree, ostree-devel, ostree-grub2, ostree-libs to 2022.1-2.el8.

How to confirm the fix worked

Confirm installed browser and Thunderbird versions meet or exceed the fixed releases; on AlmaLinux verify package versions match or exceed the stated fixed versions using package manager queries.

Typical attack path

1. Host a malicious webpage designed to trigger pointer lock immediately
2. Lure user to visit the page via phishing or compromised sites
3. Exploit missing delay to obtain unauthorized pointer lock grant
4. Abuse granted permission to intercept or manipulate user input

How to detect it

Review browser permission and security logs for rapid or unexpected pointer lock requests; examine web activity and email client logs for indicators of deceptive permission grants from external sites.

What your security team should do

• Apply browser and Thunderbird updates immediately given the permission bypass nature
• Monitor EPSS and threat intelligence feeds for any increase in exploitation activity
• Review user permission grant logs for unexpected pointer lock approvals