CVE-2024-6610

What it actually does

Form validation popups intercept the Escape key, enabling repeated triggering of messages to block exit from full-screen mode.

Why it matters to the business

Users may become trapped in full-screen browser sessions, disrupting workflows and requiring forceful application termination.

How an attack unfolds

An attacker hosts a page that triggers repeated form validation errors; once the victim enters full-screen mode, spamming the validation captures Escape key presses to prevent exit.

How to fix it

Upgrade Firefox to 128 or later and Thunderbird to 128 or later.

How to confirm the fix worked

Verify browser version is at least 128 and confirm Escape key successfully exits full-screen after repeated validation triggers.

Typical attack path

1. Host a webpage containing forms designed to trigger validation popups
2. Entice user to load the page and activate full-screen mode
3. Spam validation messages to intercept Escape key input

How to detect it

Examine user reports of being unable to exit full-screen and review browser process behavior for unexpected full-screen persistence; no centralized logs capture this client-side issue.

What your security team should do

• Apply browser updates to version 128 or newer immediately
• Educate users on avoiding untrusted sites that request full-screen
• Monitor vendor advisories for related client-side issues