CVE-2024-7518

What it actually does

A malicious webpage can position HTML select elements to visually obscure the browser's fullscreen permission notification dialog, allowing a spoofed or hidden prompt that tricks the user into granting fullscreen access.

Why it matters to the business

Users may be deceived into believing a malicious site is running in a trusted fullscreen environment, increasing the risk of phishing, credential theft, or social engineering attacks that could lead to data loss or account compromise.

How an attack unfolds

An attacker crafts a webpage that requests fullscreen mode while overlaying select dropdowns to hide the standard notification; if the user interacts without noticing the obscured prompt, fullscreen is granted and the attacker can then present a convincing fake interface for further deception.

How to fix it

Upgrade Firefox to version 129 or later, Firefox ESR to 128.1 or later, and Thunderbird to 128.1 or later. Ensure automatic updates are enabled and verify installed versions across all user devices.

How to confirm the fix worked

Confirm browser and ESR versions meet or exceed the fixed releases listed in the advisory; test that fullscreen permission dialogs are no longer visually obscured by select elements on pages that trigger the API.

Typical attack path

1. Victim navigates to attacker-controlled webpage
2. Page programmatically requests fullscreen API access
3. Select elements are positioned to obscure the native fullscreen notification dialog
4. User grants permission without realizing the request context has been hidden
5. Attacker renders a spoofed fullscreen UI to conduct phishing or further attacks

How to detect it

Review browser update logs and version inventories for instances still running pre-129 Firefox or pre-128.1 ESR/Thunderbird; no specific runtime indicators of prior exploitation are typically available for this UI spoofing issue.

What your security team should do

• Prioritize patching all Firefox and Thunderbird instances to the fixed versions within standard change windows
• Communicate the update requirement to end users and provide self-service upgrade instructions
• Monitor for any post-patch reports of similar UI spoofing behaviors in future releases