PT-2024-5893 · Mozilla+1 · Firefox+1

Hafiizh + 5 · Published 2024-09-03 · Updated 2025-11-19 · CVE-2024-8388

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 130

Description The issue is related to the notification announcing the transition to fullscreen mode in Firefox on Android. Multiple prompts and panels from both Firefox and the Android OS could be used to obscure this notification, potentially leading to spoofing of the browser UI if the user is distracted by the sudden appearance of a prompt. The notifications now use the Android Toast feature. This issue only affects Firefox on Android, with other operating systems being unaffected.

Recommendations For versions prior to 130, update to Firefox version 130 or later to resolve the issue. As a temporary workaround, consider being cautious when multiple prompts appear, ensuring to notice any visual transitions to fullscreen mode. Restricting the use of fullscreen mode until the update can also minimize the risk of exploitation.

Fix

Clickjacking

Weakness Enumeration

CWE-1021

CWE-357

Related Identifiers

ALT-PU-2024-13895

ALT-PU-2024-15839

ALT-PU-2025-11100

ALT-PU-2025-14599

BDU:2024-06696

CVE-2024-8388

OPENSUSE-SU-2024:14358-1

Affected Products

Alt Linux

Firefox

References · 27

• https://nvd.nist.gov/vuln/detail/CVE-2024-8388 · Security Note
• https://cve.org/CVERecord?id=CVE-2024-8388 · Security Note
• https://osv.dev/vulnerability/CVE-2024-8388 · Vendor Advisory
• https://mozilla.org/security/advisories/mfsa2024-39 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-8388 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-8388 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:14358-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-06696 · Security Note
• https://mozilla.org/en-US/security/advisories/mfsa2024-39 · Vendor Advisory
• https://mozilla.org/en-US/security/advisories/mfsa2024-39/#CVE-2024-8388 · Vendor Advisory
• https://cybersecurity-help.cz/vdb/SB2024090361 · Note
• https://twitter.com/VulmonFeeds/status/1830968070929514733 · Twitter Post
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-8388 · Note
• https://bugzilla.mozilla.org/show_bug.cgi?id=1902996 · Note
• https://suse.com/security/cve/CVE-2024-8387 · Note