CVE-2024-4776

What it actually does

A file dialog triggered while the browser is in full-screen mode can leave the affected window in a disabled state, impairing user interaction and potentially causing a localized denial-of-service condition within the browser UI.

Why it matters to the business

Users may experience disrupted browsing sessions requiring manual intervention to restore window functionality, increasing support burden and reducing productivity until the browser is updated across the organization.

How an attack unfolds

An attacker crafts a web page or email that prompts the victim to enter full-screen mode and then triggers a file dialog, leaving the browser window unresponsive and forcing the user to close or restart the application.

How to fix it

Upgrade Firefox to version 126 or later on all endpoints; enforce automatic updates where possible and verify the installed version through the browser's about:support page.

How to confirm the fix worked

Confirm the browser reports version 126 or higher; attempt to reproduce the original dialog scenario in full-screen mode to verify the window no longer becomes disabled.

Typical attack path

1. Victim is directed to a malicious or compromised site via phishing or watering-hole attack
2. Attacker script requests full-screen mode and subsequently opens a file-selection dialog
3. Browser window becomes disabled and remains unresponsive
4. User must manually terminate or restart the browser process to regain control

How to detect it

Review browser crash or hang reports and help-desk tickets mentioning full-screen mode or unresponsive windows; no reliable post-exploitation artifacts are typically available in standard logs.

What your security team should do

• Prioritize deployment of Firefox 126+ across all managed devices within the next patch cycle
• Enable automatic browser updates via enterprise policy
• Monitor internal support tickets for reports of unresponsive browser windows in full-screen usage