CVE-2024-4768

What it actually does

The flaw allows an attacker-controlled popup notification to bypass intended user confirmation flows when interacting with WebAuthn permission prompts, resulting in unauthorized authorization grants.

Why it matters to the business

Attackers may obtain elevated permissions on user accounts or services without explicit consent, increasing risk of account compromise, data exposure, or unauthorized actions across browser users.

How an attack unfolds

An attacker hosts a malicious page that triggers a popup notification designed to interact with a WebAuthn prompt; the user is deceived into approving the request due to the notification handling bug, granting the attacker the requested permissions.

How to fix it

Upgrade Firefox to version 126 or later, Firefox ESR to 115.11 or later, and Thunderbird to 115.11 or later. Apply updates across all managed endpoints and verify version enforcement policies.

How to confirm the fix worked

Confirm installed browser versions meet or exceed the fixed releases; test WebAuthn permission flows on updated clients to ensure prompts behave as expected without unauthorized grants.

Typical attack path

1. Deliver malicious webpage via phishing or compromised site
2. Trigger popup notification that overlaps or manipulates WebAuthn prompt
3. User interacts with the deceptive UI and grants permission
4. Attacker receives granted WebAuthn credentials or access

How to detect it

Examine browser process logs and security event logs for unexpected WebAuthn permission grants originating from untrusted domains; correlate with user reports of anomalous permission dialogs.

What your security team should do

• Prioritize browser updates within 48 hours for all user populations
• Enforce automatic update policies and monitor compliance dashboards
• Review and restrict WebAuthn usage in high-risk applications
• Educate users on verifying permission prompts before approving