TI-2024-06972 Aliases CVE-2024-7523 GHSA-w3xp-69rr-q6gw

Clickjacking in Mozilla Firefox

LOW 35CWE-1021Published 2024-08-06 · Updated 2025-03-14

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Spoofing
Confidentiality · integrity · availability: High · High · None
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-1021.

Summary

A select option could partially obscure security prompts. This could be used by a malicious site to trick a user into granting permissions. *This issue only affects Android versions of Firefox.* This vulnerability affects Firefox < 129.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00277 20th percentileScored 2026-11-07

Fix Fixed Firefox (Mozilla): 129

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Mozilla	Firefox	before 129	129	Patch available	CNA

Firefox VendorMozilla Affected before 129 Fixed in 129 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:mozilla:firefox_mobile::::::android::*	before 129	Vulnerable	Mozilla

cpe:2.3:a:mozilla:firefox_mobile:*:*:*:*:*:android:*:* Versions before 129 Vulnerable ·Mozilla

Remediation

Fix · CNA Firefox (Mozilla) Fixed in 129

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2024-08-06
Mozilla Firefox 129
14 records Highest priority Priority MEDIUM 9 MEDIUM, 5 LOW
Other records, highest priority first
- TI-2024-06970 Improper handling of exceptional conditions in Mozilla FirefoxPriority MEDIUM 50
- TI-2024-06979 Use after free in Mozilla FirefoxPriority MEDIUM 49
- TI-2024-06977 Use after free in Mozilla FirefoxPriority MEDIUM 49
Show all 14 records →

Timeline

2026-10-02 Threatist record created from CVE-2024-7523
2026-10-03 Alias added: GHSA-w3xp-69rr-q6gw

References

Advisory 1

https://www.mozilla.org/security/advisories/mfsa2024-33/

Other 1

https://bugzilla.mozilla.org/show_bug.cgi?id=1908344

TI-2022-09832 Use after free in Mozilla Firefox KEVCVSS 3.1CRITICAL 9.6
TI-2022-09831 Use after free in Mozilla Firefox KEVCVSS 3.1HIGH 8.8
TI-2023-13905 Race condition in Mozilla Firefox for Android CVSS 3.1HIGH 7.5
TI-2023-13916 A wrong lowering instruction in the ARM64 Ion compiler resulted in a wrong optimization… CVSS 3.1MEDIUM 6.5
TI-2023-13903 Following a Garbage Collector compaction, weak maps may have been accessed before they… CVSS 3.1MEDIUM 6.5
TI-2022-13642 Information disclosure in Mozilla Firefox for iOS CVSS 3.1MEDIUM 6.5

See all 86 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences