PT-2024-10061 · Mozilla+2 · Thunderbird+3
Shaheen Fazim
·
Published
2024-11-25
·
Updated
2025-11-19
·
CVE-2024-11700
CVSS v2.0
9.4
High
| Vector | AV:N/AC:L/Au:N/C:C/I:C/A:N |
Name of the Vulnerable Software and Affected Versions
Firefox versions prior to 133
Thunderbird versions prior to 133
Description
The issue is related to incorrect restriction of visualized user interface layers in Mozilla Firefox and Thunderbird on Android operating systems. This could allow a remote attacker to perform a tapjacking attack, potentially leading to users unknowingly approving the launch of external applications and exposing them to underlying vulnerabilities. Malicious websites may have exploited this to perform user intent confirmation through tapjacking.
Recommendations
For Firefox versions prior to 133, update to version 133 or later to resolve the issue.
For Thunderbird versions prior to 133, update to version 133 or later to resolve the issue.
As a temporary workaround, consider restricting access to external applications until a patch is available.
Avoid using affected Firefox and Thunderbird versions on untrusted networks to minimize the risk of exploitation.
Fix
Clickjacking
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Astra Linux
Firefox
Thunderbird