CVE-2024-5689

What it actually does

A malicious website can detect screenshot activity in Firefox and overlay a fake 'My Shots' button that redirects users to a phishing replica of the Firefox Screenshots service.

Why it matters to the business

Users may be tricked into entering credentials or sensitive information on a fake site, resulting in account takeovers, data theft, or further malware infection with minimal direct operational disruption to the organization.

How an attack unfolds

An attacker hosts a webpage that monitors for screenshot events, dynamically overlays the legitimate-looking button, and on click sends the victim to an attacker-controlled replica page designed to harvest credentials or deliver payloads.

How to fix it

Upgrade Firefox to version 127 or later on all endpoints; enforce automatic browser updates through enterprise policy where possible.

How to confirm the fix worked

Query browser version strings across the fleet and confirm no installations remain below 127; test that screenshot detection no longer triggers the overlay on representative sites.

Typical attack path

1. Victim visits attacker-controlled or compromised website in vulnerable Firefox
2. Site detects screenshot attempt and renders overlay button
3. User clicks button believing it is the native My Shots feature
4. Browser navigates to phishing replica of Firefox Screenshots page
5. Attacker captures credentials or initiates further social-engineering steps

How to detect it

Review web proxy logs and browser history for navigation to unexpected screenshots.mozilla.org or similar domains immediately following screenshot events; inspect for DOM overlays or unexpected redirects in forensic browser artifacts.

What your security team should do

• Prioritize immediate deployment of Firefox 127+ via centralized update mechanisms
• Block known phishing domains associated with the replica page in web proxies and DNS filters
• Run targeted user-awareness messaging about screenshot-related phishing lures
• Monitor browser telemetry or EDR for unexpected navigation to screenshots-related domains