CVE-2024-9391

A user who enables full-screen mode on a specially crafted web page could potentially be prevented from exiting full screen mode. This may allow spoofing of other sites as the address bar is no longer visible. This bug only affects Firefox Focus for Android. Other versions of Firefox are unaffected. This vulnerability affects Firefox < 131.

Weakness

This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.

Related Attack Patterns

• https://cwe.mitre.org/data/definitions/21.html
• https://cwe.mitre.org/data/definitions/22.html
• https://cwe.mitre.org/data/definitions/459.html
• https://cwe.mitre.org/data/definitions/461.html
• https://cwe.mitre.org/data/definitions/473.html
• https://cwe.mitre.org/data/definitions/476.html
• https://cwe.mitre.org/data/definitions/59.html
• https://cwe.mitre.org/data/definitions/60.html
• https://cwe.mitre.org/data/definitions/667.html
• https://cwe.mitre.org/data/definitions/94.html

References

• https://bugzilla.mozilla.org/show_bug.cgi?id=1892407
• https://www.mozilla.org/security/advisories/mfsa2024-46/