Vulnerability in Google Android
CVE-2024-8388
Multiple prompts and panels from both Firefox and the Android OS could be used to obscure the notification announcing the transition to fullscreen mode after the fix for CVE-2023-6870 in Firefox 121. This could lead to spoofing the browser UI if the sudden appearance of the prompt distracted the user from noticing the visual transition happening behind the prompt. These notifications now use the Android Toast feature. *This bug only affects Firefox on Android. Other operating systems are unaffected.* This vulnerability affects Firefox < 130.
EPSS: 0.003 (26.7th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N.
Affected products
- Google Android
- Mozilla Firefox — versions unspecified
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security@mozilla.org (Broken Link)
- security@mozilla.org (Permissions Required, Issue Tracking)
- security@mozilla.org (Vendor Advisory)
Frequently asked questions
- What is CVE-2024-8388?
- CVE-2024-8388 is a medium-severity vulnerability in Google Android, classified under Improper Restriction of Rendered UI Layers or Frames (Clickjacking). CVSS score: 5.3/10. Published 2024-09-03.
- How severe is CVE-2024-8388?
- Medium severity. CVSS v3 base score is 5.3 out of 10.
- Is CVE-2024-8388 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.