CVE-2024-7529

What it actually does

A date picker can be positioned to partially obscure security permission prompts, enabling visual deception that tricks users into granting permissions to a malicious site.

Why it matters to the business

Attackers may obtain unauthorized permissions leading to data exposure, account compromise, or further system access on affected user devices; high ecosystem prevalence of browser usage increases urgency despite low EPSS.

How an attack unfolds

An attacker crafts a malicious site that triggers a date picker overlaying browser security dialogs; users are deceived into interacting with the prompt, granting permissions. Threat actor campaigns involving espionage and financial motives have targeted similar browser flaws.

How to fix it

Upgrade Firefox to 129+, Firefox ESR to 115.14+ or 128.1+, Thunderbird to 128.1+ or 115.14+. For authd on AlmaLinux 8 update to version 1.4.4-5.el8_0.1 immediately given CISA-style urgency for high-impact UI flaws.

How to confirm the fix worked

Confirm installed versions meet or exceed the fixed releases listed; perform manual testing of date picker interactions against permission prompts to verify no obscuring occurs.

Typical attack path

1. Host a malicious webpage containing a date input field
2. Trigger the date picker to overlap a permission prompt
3. User interacts with the obscured prompt believing it is legitimate
4. Permissions such as camera or location are granted to the attacker site

How to detect it

Inspect browser permission logs and history for grants originating from unexpected domains; correlate with threat actor campaigns noted in 2024 zero-day exploitation reports; review update status against published fixed versions.

What your security team should do

• Apply updates to all affected Mozilla products without delay
• Monitor EPSS trend and threat actor activity for escalation
• Implement user awareness on verifying permission prompts
• Scan for authd package version 1.4.4-5.el8_0.1 deployment across environments