CVE-2024-6607

What it actually does

The vulnerability allows a malicious site to trap the user in pointer lock mode despite escape key presses and to overlay custom validity error notifications from a select element over browser permission prompts, enabling unauthorized permission grants.

Why it matters to the business

Attackers can obtain elevated browser permissions such as camera, microphone or location access without genuine user consent, increasing risk of data theft, surveillance or further compromise across user populations running unpatched browsers.

How an attack unfolds

An attacker hosts a crafted web page that immediately requests pointer lock and permission prompts, suppresses the escape key behavior, and renders deceptive overlay messages from a select element to trick the user into approving the prompts.

How to fix it

Upgrade Firefox and Thunderbird to version 128 or later. Enforce automatic browser updates through enterprise management tools and verify deployed versions across all endpoints.

How to confirm the fix worked

Confirm all instances report version 128 or higher via about:support or equivalent; re-test the affected pointer-lock and permission prompt behaviors in the updated release to ensure escape key and overlay protections function.

Typical attack path

1. User visits attacker-controlled site via phishing or malicious advertisement
2. Page immediately enters pointer-lock and triggers permission request dialogs
3. Escape key handling is suppressed while customValidity notifications are overlaid on the dialogs
4. User is socially engineered into granting permissions believing the prompts are legitimate
5. Site receives camera, microphone, geolocation or other sensitive permissions

How to detect it

Review browser permission grant logs and history for unexpected approvals; examine web server access logs for visits to domains that heavily use pointer-lock combined with select elements and permission APIs; no persistent artifacts remain after the session.

What your security team should do

• Prioritize immediate deployment of version 128 or newer to all users
• Enable and monitor browser update telemetry to confirm coverage
• Review and reduce the set of sites granted persistent permissions
• Educate users on verifying permission prompts before approval