CVE-2024-5698

What it actually does

Manipulating the fullscreen feature while opening a data-list allows an attacker to overlay a text box over the address bar, enabling visual spoofing of the browser UI.

Why it matters to the business

Users may be tricked into interacting with malicious content believing it is from a trusted site, increasing successful phishing or credential theft risks across the organization with low but persistent exposure due to stable low exploit probability and no known active campaigns.

How an attack unfolds

An attacker hosts a crafted webpage that triggers the fullscreen manipulation during data-list interaction to visually spoof the address bar, leading users to enter data on a fake site; no named threat actors or ransomware usage reported and low EPSS indicates limited real-world exploitation so far.

How to fix it

Update all Firefox instances to version 127 or newer to resolve the UI overlay issue; apply browser updates organization-wide as soon as possible given the published date and lack of KEV listing.

How to confirm the fix worked

Verify deployed Firefox versions meet or exceed 127; test the fullscreen and data-list scenario in a controlled environment to confirm no address bar overlay occurs.

Typical attack path

1. Host a malicious webpage exploiting the fullscreen and data-list interaction
2. Social engineer the victim into visiting the page and performing specific interactions
3. Trigger overlay to spoof the address bar content
4. Capture user input or actions under false pretenses of legitimacy

How to detect it

Review browser telemetry or proxy logs for unusual fullscreen API usage combined with data-list elements leading to unexpected navigation or form submissions; check for post-exploitation indicators like credential submission to suspicious domains given the low EPSS and absence from KEV.

What your security team should do

• Deploy Firefox 127+ updates immediately across all endpoints
• Monitor browser update compliance metrics
• Reinforce user awareness on verifying URLs independently of displayed address bars