CVE-2024-0750 is a flaw in how Firefox calculates the delay on popup notifications, which could trick a user into granting permissions. NVD scores it 8.8 High, while Mozilla rates it Moderate. Mozilla fixed it in Firefox 122 and in Firefox ESR 115.7, so update.
What's affected
The record says Firefox before 122, Firefox ESR before 115.7 and Thunderbird before 115.7 are affected. Mozilla advisories mfsa2024-01 and mfsa2024-02 list the fix in Firefox 122 and Firefox ESR 115.7. The pages I read did not list Thunderbird for this CVE, so confirm the Thunderbird fix on its own advisory. The weakness is CWE-451, user interface misrepresentation of critical information. Mozilla credits the report to Hafiizh.
The CVSS vector in the record is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. Source conflict: NVD gives 8.8 (High) while Mozilla rates the issue Moderate. NVD assumes the worst result of a granted permission, while Mozilla's rating reflects the need for a user to be tricked. Plan around the higher number.
How to check if you're exposed
In Firefox, open the menu, choose Help, then About Firefox, and read the version. It will also start an update check. For a scripted check, the command line reports it:
firefox --version
On Debian or Ubuntu systems that use the distribution package, dpkg -l firefox-esr thunderbird lists the installed package versions. Distribution packages carry their own version strings, so read the distributor's advisory for the mapping.
Browsers are also embedded in other tools, so look beyond the desktop icon. Kiosks, managed images and portable copies often lag behind.
What to do now
- Update Firefox, Firefox ESR or Thunderbird to a fixed version listed above.
- Restart the application. Updates apply fully only after a restart.
- In managed fleets, push the update through your software management tool and report on machines that have not restarted.
- If you cannot update at once, reduce risk by avoiding untrusted sites and by not opening untrusted mail attachments or links in Thunderbird.
- Keep automatic updates on so the next Mozilla security advisory reaches users without a ticket.
Why it matters
Permission prompts are a trust boundary: the browser asks the user before a page can use the camera, location, notifications or similar powers. A timing flaw in the popup delay logic meant a page might get a click on a prompt before the user could read it. Mozilla describes it as a way to trick a user into granting permissions.
This is a user interface class of weakness rather than memory corruption. It needs a user to click, and what the attacker gains depends on which permission is granted. Updating removes the problem, and reviewing granted site permissions is a cheap extra check.
The record does not mark this CVE as known exploited, and the Mozilla advisories I read do not say it has been used in attacks. Browser vulnerabilities are patched in bulk each cycle, so the right habit is to keep the whole fleet current rather than track single CVEs.
If the affected component is something your own code pulls in as a dependency, the free in-browser dependency scan at gold.safeguard.sh/scan will tell you whether it appears in your manifests. Reachability analysis then helps you separate the copies that your code actually exercises from the ones that only sit in the tree.
Quick check
Why do NVD and Mozilla disagree?
They weigh the user click differently. NVD's vector scores the worst case once a permission is granted, while Mozilla rated the issue Moderate.
Should I review site permissions?
It is a reasonable step. In Firefox, open Settings, then Privacy and Security, then Permissions, and remove anything you do not recognize.
Sources
Last reviewed: 19 October 2026.
