CVE-2024-6608

What it actually does

The vulnerability permits an attacker-controlled iframe to manipulate the mouse cursor position beyond the browser viewport and window boundaries via the Pointer Lock API.

Why it matters to the business

Attackers could potentially create misleading user interface interactions in browser or email client sessions, increasing risks of phishing or unintended user actions across web-facing applications.

How an attack unfolds

An attacker hosts a webpage containing a malicious iframe that activates pointer lock to reposition the cursor outside the visible Firefox or Thunderbird window, enabling further UI deception or interaction hijacking without named threat actor involvement.

How to fix it

Upgrade Firefox to version 128 or later and Thunderbird to version 128 or later to restore pointer lock restrictions.

How to confirm the fix worked

Verify installed versions meet or exceed 128; test pointer lock behavior from iframes to confirm cursor remains confined to viewport and window.

Typical attack path

1. User visits attacker-controlled webpage or email content
2. Embedded iframe requests pointer lock
3. Cursor is repositioned outside viewport and application window
4. Attacker leverages repositioned cursor for subsequent UI manipulation

How to detect it

Review browser telemetry and application logs for unexpected pointer lock activations originating from cross-origin iframes.

What your security team should do

• Prioritize updates for all Firefox and Thunderbird instances to version 128 or newer
• Review web content policies to limit untrusted iframe usage
• Monitor EPSS and exploit maturity trends for any future increase in risk