Search for vulnerabilities
Vulnerability details: VCID-k6yj-fr1k-d3e8
Vulnerability ID VCID-k6yj-fr1k-d3e8
Aliases CVE-2024-1550
Summary A malicious website could have used a combination of exiting fullscreen mode and requestPointerLock to cause the user's mouse to be re-positioned unexpectedly, which could have led to user confusion and inadvertently granting permissions they did not intend to grant.
Status Published
Exploitability 0.5
Weighted Severity 8.0
Risk 4.0
Affected and Fixed Packages Package Details
Weaknesses (1)
CWE-1021 Improper Restriction of Rendered UI Layers or Frames
System Score Found at
cvssv3 6.1 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-1550.json
epss 0.00202 https://api.first.org/data/v1/epss?cve=CVE-2024-1550
epss 0.00202 https://api.first.org/data/v1/epss?cve=CVE-2024-1550
epss 0.00207 https://api.first.org/data/v1/epss?cve=CVE-2024-1550
epss 0.00219 https://api.first.org/data/v1/epss?cve=CVE-2024-1550
epss 0.00219 https://api.first.org/data/v1/epss?cve=CVE-2024-1550
epss 0.00219 https://api.first.org/data/v1/epss?cve=CVE-2024-1550
epss 0.00219 https://api.first.org/data/v1/epss?cve=CVE-2024-1550
epss 0.00219 https://api.first.org/data/v1/epss?cve=CVE-2024-1550
epss 0.00253 https://api.first.org/data/v1/epss?cve=CVE-2024-1550
epss 0.00253 https://api.first.org/data/v1/epss?cve=CVE-2024-1550
epss 0.00253 https://api.first.org/data/v1/epss?cve=CVE-2024-1550
epss 0.00253 https://api.first.org/data/v1/epss?cve=CVE-2024-1550
epss 0.00253 https://api.first.org/data/v1/epss?cve=CVE-2024-1550
epss 0.00253 https://api.first.org/data/v1/epss?cve=CVE-2024-1550
epss 0.00253 https://api.first.org/data/v1/epss?cve=CVE-2024-1550
epss 0.00253 https://api.first.org/data/v1/epss?cve=CVE-2024-1550
epss 0.00253 https://api.first.org/data/v1/epss?cve=CVE-2024-1550
epss 0.00253 https://api.first.org/data/v1/epss?cve=CVE-2024-1550
cvssv3.1 6.1 https://bugzilla.mozilla.org/show_bug.cgi?id=1860065
ssvc Track https://bugzilla.mozilla.org/show_bug.cgi?id=1860065
cvssv3.1 6.1 https://lists.debian.org/debian-lts-announce/2024/03/msg00000.html
ssvc Track https://lists.debian.org/debian-lts-announce/2024/03/msg00000.html
cvssv3.1 6.1 https://lists.debian.org/debian-lts-announce/2024/03/msg00001.html
ssvc Track https://lists.debian.org/debian-lts-announce/2024/03/msg00001.html
cvssv3.1 6.1 https://nvd.nist.gov/vuln/detail/CVE-2024-1550
generic_textual high https://www.mozilla.org/en-US/security/advisories/mfsa2024-05
generic_textual high https://www.mozilla.org/en-US/security/advisories/mfsa2024-06
generic_textual high https://www.mozilla.org/en-US/security/advisories/mfsa2024-07
cvssv3.1 6.1 https://www.mozilla.org/security/advisories/mfsa2024-05/
ssvc Track https://www.mozilla.org/security/advisories/mfsa2024-05/
cvssv3.1 6.1 https://www.mozilla.org/security/advisories/mfsa2024-06/
ssvc Track https://www.mozilla.org/security/advisories/mfsa2024-06/
cvssv3.1 6.1 https://www.mozilla.org/security/advisories/mfsa2024-07/
ssvc Track https://www.mozilla.org/security/advisories/mfsa2024-07/
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-1550.json
https://api.first.org/data/v1/epss?cve=CVE-2024-1550
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-1546
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-1547
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-1548
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-1549
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-1550
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-1551
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-1552
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-1553
2265353 https://bugzilla.redhat.com/show_bug.cgi?id=2265353
cpe:2.3:a:mozilla:firefox:*:*:*:*:-:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:mozilla:firefox:*:*:*:*:-:*:*:*
cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:*
cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
CVE-2024-1550 https://nvd.nist.gov/vuln/detail/CVE-2024-1550
mfsa2024-05 https://www.mozilla.org/en-US/security/advisories/mfsa2024-05
mfsa2024-05 https://www.mozilla.org/security/advisories/mfsa2024-05/
mfsa2024-06 https://www.mozilla.org/en-US/security/advisories/mfsa2024-06
mfsa2024-06 https://www.mozilla.org/security/advisories/mfsa2024-06/
mfsa2024-07 https://www.mozilla.org/en-US/security/advisories/mfsa2024-07
mfsa2024-07 https://www.mozilla.org/security/advisories/mfsa2024-07/
msg00000.html https://lists.debian.org/debian-lts-announce/2024/03/msg00000.html
msg00001.html https://lists.debian.org/debian-lts-announce/2024/03/msg00001.html
RHSA-2024:0952 https://access.redhat.com/errata/RHSA-2024:0952
RHSA-2024:0955 https://access.redhat.com/errata/RHSA-2024:0955
RHSA-2024:0957 https://access.redhat.com/errata/RHSA-2024:0957
RHSA-2024:0958 https://access.redhat.com/errata/RHSA-2024:0958
RHSA-2024:0959 https://access.redhat.com/errata/RHSA-2024:0959
RHSA-2024:0960 https://access.redhat.com/errata/RHSA-2024:0960
RHSA-2024:0961 https://access.redhat.com/errata/RHSA-2024:0961
RHSA-2024:0962 https://access.redhat.com/errata/RHSA-2024:0962
RHSA-2024:0963 https://access.redhat.com/errata/RHSA-2024:0963
RHSA-2024:0964 https://access.redhat.com/errata/RHSA-2024:0964
RHSA-2024:0968 https://access.redhat.com/errata/RHSA-2024:0968
RHSA-2024:0969 https://access.redhat.com/errata/RHSA-2024:0969
RHSA-2024:0970 https://access.redhat.com/errata/RHSA-2024:0970
RHSA-2024:0971 https://access.redhat.com/errata/RHSA-2024:0971
RHSA-2024:0972 https://access.redhat.com/errata/RHSA-2024:0972
RHSA-2024:0976 https://access.redhat.com/errata/RHSA-2024:0976
RHSA-2024:0983 https://access.redhat.com/errata/RHSA-2024:0983
RHSA-2024:0984 https://access.redhat.com/errata/RHSA-2024:0984
show_bug.cgi?id=1860065 https://bugzilla.mozilla.org/show_bug.cgi?id=1860065
USN-6649-1 https://usn.ubuntu.com/6649-1/
USN-6669-1 https://usn.ubuntu.com/6669-1/
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-1550.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Found at https://bugzilla.mozilla.org/show_bug.cgi?id=1860065
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-02-20T16:17:48Z/ Found at https://bugzilla.mozilla.org/show_bug.cgi?id=1860065
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Found at https://lists.debian.org/debian-lts-announce/2024/03/msg00000.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-02-20T16:17:48Z/ Found at https://lists.debian.org/debian-lts-announce/2024/03/msg00000.html
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Found at https://lists.debian.org/debian-lts-announce/2024/03/msg00001.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-02-20T16:17:48Z/ Found at https://lists.debian.org/debian-lts-announce/2024/03/msg00001.html
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2024-1550
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Found at https://www.mozilla.org/security/advisories/mfsa2024-05/
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-02-20T16:17:48Z/ Found at https://www.mozilla.org/security/advisories/mfsa2024-05/
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Found at https://www.mozilla.org/security/advisories/mfsa2024-06/
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-02-20T16:17:48Z/ Found at https://www.mozilla.org/security/advisories/mfsa2024-06/
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Found at https://www.mozilla.org/security/advisories/mfsa2024-07/
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-02-20T16:17:48Z/ Found at https://www.mozilla.org/security/advisories/mfsa2024-07/
Exploit Prediction Scoring System (EPSS)
Percentile 0.42598
EPSS Score 0.00202
Published At Aug. 14, 2025, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2025-07-31T08:09:05.515711+00:00 Mozilla Importer Import https://github.com/mozilla/foundation-security-advisories/blob/master/announce/2024/mfsa2024-07.yml 37.0.0