CVE-2024-4766
📋 TL;DR
This vulnerability allows attackers to hide the fullscreen notification in Firefox for Android, potentially tricking users into interacting with spoofed content. Only Firefox for Android versions before 126 are affected; desktop Firefox and other browsers are not vulnerable.
💻 Affected Systems
- Firefox for Android
📦 What is this software?
Firefox by Mozilla
⚠️ Risk & Real-World Impact
Worst Case
Attackers could create convincing phishing pages that appear as legitimate fullscreen applications, leading to credential theft or malware installation.
Likely Case
Users might be tricked into clicking malicious links or providing sensitive information on spoofed websites.
If Mitigated
With updated browsers, users see proper fullscreen notifications and can identify suspicious behavior.
🎯 Exploit Status
Exploitation requires user interaction (visiting a malicious website) but doesn't require authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Firefox for Android 126
Vendor Advisory: https://www.mozilla.org/security/advisories/mfsa2024-21/
Restart Required: Yes
Instructions:
1. Open Google Play Store. 2. Search for Firefox. 3. Tap Update. 4. Restart Firefox after update completes.
🔧 Temporary Workarounds
Disable JavaScript
androidPrevents malicious scripts from hiding fullscreen notifications
about:config → javascript.enabled → false
Use Desktop Mode
androidForces websites to load in desktop view which may bypass fullscreen tricks
Menu → Request Desktop Site
🧯 If You Can't Patch
- Use alternative mobile browsers like Chrome or Safari temporarily
- Avoid visiting untrusted websites on Firefox for Android
🔍 How to Verify
Check if Vulnerable:
Open Firefox for Android → Menu → Settings → About Firefox → Check version numberCheck Version:
about:Verify Fix Applied:
Confirm version is 126 or higher in About Firefox settings📡 Detection & Monitoring
Log Indicators:
- Unusual fullscreen permission requests in browser logs
- Multiple rapid fullscreen toggle events
Network Indicators:
- HTTP requests to domains with suspicious fullscreen JavaScript patterns
SIEM Query:
source="firefox_android" AND (event="fullscreen" OR event="permission_request") AND count > threshold🔗 References
- https://bugzilla.mozilla.org/show_bug.cgi?id=1871214
- https://bugzilla.mozilla.org/show_bug.cgi?id=1871217
- https://www.mozilla.org/security/advisories/mfsa2024-21/
- https://bugzilla.mozilla.org/show_bug.cgi?id=1871214
- https://bugzilla.mozilla.org/show_bug.cgi?id=1871217
- https://www.mozilla.org/security/advisories/mfsa2024-21/
