CVE-2024-5697

What it actually does

A website can observe and react to the browser's internal screenshot capture event, disclosing the timing of a user's screenshot action.

Why it matters to the business

Organizations face increased privacy risk for users, potential regulatory scrutiny over data collection practices, and loss of trust when browser protections fail to hide routine user actions.

How an attack unfolds

An attacker hosts a webpage that registers for the browser's screenshot notification; when the user activates Firefox's built-in screenshot tool the page receives the event and can log, transmit, or act on the information.

How to fix it

Upgrade Firefox to version 127 or later; enforce browser updates through enterprise management tools and verify the deployed version on managed endpoints.

How to confirm the fix worked

Confirm Firefox version is 127 or higher; attempt to reproduce the screenshot detection on a test page and verify the event is no longer observable.

Typical attack path

1. Attacker crafts and hosts a malicious webpage containing JavaScript to monitor screenshot events
2. User visits the page with an affected Firefox version
3. User activates the built-in screenshot functionality
4. Page receives the detection event and exfiltrates the timing or performs additional actions

How to detect it

Review web server access logs and browser telemetry for visits to domains known to test screenshot APIs; inspect JavaScript on high-risk sites for code registering screenshot listeners.

What your security team should do

• Prioritize deployment of Firefox 127+ across all managed devices within 30 days
• Add browser version checks to existing endpoint compliance scans
• Review web applications for any reliance on screenshot detection and remove such logic