CVE-2024-7523

What it actually does

A select HTML element can be positioned to partially overlay and obscure portions of native security permission prompts in the Firefox Android browser, allowing a malicious webpage to hide warning text or options from the user.

Why it matters to the business

Users on Android devices may inadvertently grant web permissions such as camera, microphone, or location access to untrusted sites, increasing risk of privacy violations or further compromise on personal mobile devices.

How an attack unfolds

An attacker hosts a webpage containing a carefully styled select dropdown that overlaps the permission prompt; when the user interacts with the page, the obscured dialog leads them to confirm the grant without seeing the full context or risks.

How to fix it

Upgrade Firefox on Android to version 129 or later; enforce enterprise browser update policies and disable unnecessary web permissions where possible.

How to confirm the fix worked

Verify Firefox version is 129 or higher; attempt to reproduce the overlay behavior with test pages containing positioned select elements against permission dialogs.

Typical attack path

1. User visits attacker-controlled website in Firefox on Android
2. Page renders a select element that partially covers the permission prompt
3. User interacts with the visible portion of the prompt and grants access
4. Attacker gains requested permission for further abuse

How to detect it

Review browser permission logs and history for unexpected grants to unknown domains; correlate with web navigation logs for suspicious sites around the time of permission changes.

What your security team should do

• Immediately deploy Firefox 129+ across all Android endpoints
• Educate users on verifying permission prompts before granting access
• Review and audit granted web permissions in browser settings
• Monitor EPSS and exploit maturity for any future increase in risk