Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
4.3
CVE-2024-6610: Form validation popups could capture escape key presses. Therefore, spamming form validation messages could be used to prevent users from exiting full-screen mode. This vulnerability affects Firefo...
CVE-2024-6610 · published 2 years ago
Summary
Form validation popups could capture escape key presses. Therefore, spamming form validation messages could be used to prevent users from exiting full-screen mode. This vulnerability affects Firefox < 128 and Thunderbird < 128.
What to do
- Update mozilla firefox to version 128.0 or later.
- Update mozilla thunderbird to version 128.0 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| mozilla | firefox |
< 128.0 cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:* |
| mozilla | thunderbird |
< 128.0 cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:* |
Original advisory text
Form validation popups could capture escape key presses. Therefore, spamming form validation messages could be used to prevent users from exiting full-screen mode. This vulnerability affects Firefo...
Form validation popups could capture escape key presses. Therefore, spamming form validation messages could be used to prevent users from exiting full-screen mode. This vulnerability affects Firefox < 128 and Thunderbird < 128.
References
- https://bugzilla.mozilla.org/show_bug.cgi?id=1883396 Issue Tracking Permissions Required
- https://www.mozilla.org/security/advisories/mfsa2024-29/ Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2024-32/ Vendor Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-451User Interface (UI) Misrepresentation of Critical Information
Timeline
Published9 Jul 2024
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2024-6610 · NVD
Track software like this
Free during beta