Mozilla Firefox up to 126 Screenshots ui layer

Summaryinfo

A vulnerability marked as critical has been reported in Mozilla Firefox up to 126. This affects an unknown part of the component Screenshots Handler. The manipulation leads to ui layer. This vulnerability is traded as CVE-2024-5689. It is possible to initiate the attack remotely. There is no exploit available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability was found in Mozilla Firefox up to 126. It has been rated as critical. This issue affects an unknown code of the component Screenshots Handler. The manipulation with an unknown input leads to a ui layer vulnerability. Using CWE to declare the problem leads to CWE-1021. The web application does not restrict or incorrectly restricts frame objects or UI layers that belong to another application or domain, which can lead to user confusion about which interface the user is interacting with. Impacted is integrity. The summary by CVE is:

In addition to detecting when a user was taking a screenshot (XXX), a website was able to overlay the 'My Shots' button that appeared, and direct the user to a replica Firefox Screenshots page that could be used for phishing. This vulnerability affects Firefox < 127.

The advisory is shared at bugzilla.mozilla.org. The identification of this vulnerability is CVE-2024-5689 since 06/06/2024. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. It demands that the victim is doing some kind of user interaction. Neither technical details nor an exploit are publicly available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 08/17/2025).

The vulnerability scanner Nessus provides a plugin with the ID 250080 (Linux Distros Unpatched Vulnerability : CVE-2024-5689), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 127 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (250080). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Web Browser

Vendor

• Mozilla

Name

• Firefox

Version

• 126

License

• open-source

Website

• Vendor: https://www.mozilla.org/
• Product: https://www.mozilla.org/en-US/firefox/

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion