CVE-2024-10004
📋 TL;DR
This vulnerability in Firefox for iOS causes the browser to incorrectly display an HTTPS padlock icon when opening an external HTTP link after the app was previously closed with an HTTPS tab open. This visual misrepresentation could trick users into believing they're on a secure HTTPS site when they're actually on an insecure HTTP connection. Only Firefox for iOS users are affected.
💻 Affected Systems
- Firefox for iOS
📦 What is this software?
Firefox by Mozilla
⚠️ Risk & Real-World Impact
Worst Case
Users could be tricked into entering sensitive information (passwords, credit card details) on HTTP sites they believe are HTTPS, leading to credential theft and man-in-the-middle attacks.
Likely Case
Users might unknowingly browse HTTP sites thinking they're secure, potentially exposing non-critical information or session data to interception.
If Mitigated
With proper user awareness and other security controls, the impact is limited to visual confusion without actual data compromise.
🎯 Exploit Status
Exploitation requires user interaction (clicking a malicious link) but no authentication or special privileges.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 131.2
Vendor Advisory: https://www.mozilla.org/security/advisories/mfsa2024-54/
Restart Required: Yes
Instructions:
1. Open the App Store on iOS. 2. Search for Firefox. 3. Tap Update to install version 131.2 or later. 4. Restart Firefox after update completes.
🔧 Temporary Workarounds
Avoid External Links
allManually type URLs instead of clicking external links when Firefox iOS was previously closed.
Clear Tabs on Close
allClose all tabs before closing Firefox iOS to prevent the vulnerable state.
🧯 If You Can't Patch
- Use alternative browsers for sensitive browsing until patched
- Educate users to manually verify URLs and not rely solely on padlock icons
🔍 How to Verify
Check if Vulnerable:
Check Firefox iOS version in Settings > Firefox > About. If version is below 131.2, you are vulnerable.Check Version:
Not applicable for iOS apps - check via App Store or app settingsVerify Fix Applied:
After updating, verify version is 131.2 or higher in Settings > Firefox > About.📡 Detection & Monitoring
Log Indicators:
- No server-side logs available for this client-side vulnerability
Network Indicators:
- No network-based detection possible as this is a UI bug
SIEM Query:
Not applicable - client-side visual bug