PatchGap
Firefox · Toolkit

CVE-2024-10465

Spoofing in Toolkit
Low CVSS 6.5 firefox Spoofing 🔧 Commit mapped

Overview

Low
Severity
6.5
CVSS
No
Exploited ITW
Fixed
Fix Status
Impactlow
DescriptionA clipboard "paste" button could persist across tabs which allowed a spoofing attack.
ComponentToolkit
Bug ClassSpoofing
Tracker1918853
Fix commit1814a92b7f83 (firefox) +1/-0
CWECWE-290
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
CISA KEVNot listed
CreditedKang Ali and Nur Fadhillah of Punggawa Cybersecurity
Disclosed2024-10-29

Background

`ClipboardContextMenu`
A Firefox toolkit module (toolkit/modules/ClipboardContextMenu.sys.mjs) that builds the small context menu offering a “paste” action when web content requests clipboard access.
`menupopup`
The XUL element that hosts the paste menuitem, created via createXULElement and identified by this.MENU_POPUP_ID.
`tabspecific`
A XUL popup attribute that ties a popup’s lifetime to the tab that opened it, causing the browser to auto-dismiss the popup when the user switches tabs.

Root Cause Analysis

The vulnerable code path is in ClipboardContextMenu’s popup-construction routine, where the menupopup element carrying the “paste” menuitem was created and appended to the chrome document without any binding to the originating tab. Because the popup lacked the tabspecific attribute, the browser’s popup-management logic had no signal to close it on a tab switch, violating the invariant that content-triggered UI should remain scoped to the tab that produced it.

As a result, a paste button spawned by one tab’s page could remain visible after the user navigated to a different tab, letting the button appear to belong to the newly focused (potentially attacker-unrelated) page.

The fix sets menupopup.setAttribute("tabspecific", "true"), so the popup is now automatically dismissed when the active tab changes. This restores the scoping invariant and removes the window in which a stale button could be misattributed to another tab’s content.

Key insight
The single core mistake was omitting the tabspecific marker on the paste menupopup, which left a content-initiated popup untethered from its originating tab; adding tabspecific="true" lets the browser tear the popup down on tab switches, eliminating the cross-tab persistence that enabled spoofing.

Attack Path

  1. Trigger the paste UI A malicious page invokes a clipboard read that causes ClipboardContextMenu to build and show the paste menupopup in the current tab.
  2. Leave the popup open The attacker’s page arranges for the popup to remain displayed rather than being immediately consumed by the user.
  3. Induce a tab switch The user (or a script-driven interaction) moves focus to a different tab while the untethered menupopup is still on screen.
  4. Spoof context The stale paste button now overlays or appears alongside the newly focused tab’s content, so the user perceives it as belonging to that unrelated page.
  5. Capture the interaction The user clicks the misattributed button, performing a clipboard action they believe is scoped to the current tab rather than the attacker’s original context.

Impact Assessment

An attacker gains a UI-spoofing primitive in the browser chrome, causing a clipboard “paste” button to persist across tabs and appear to belong to a page that did not request it. This is a low-severity logic error confined to the front-end UI context and requires the user to trigger clipboard access and then switch tabs while the popup remains open. No memory corruption or direct data disclosure results; the risk is limited to misleading the user about which tab a paste action applies to.

Files Changed

  • toolkit/modules/ClipboardContextMenu.sys.mjs

Audit Directions

  • Untethered content popups
    Review other modules that create menupopup or similar XUL popups in response to web content and confirm each sets tabspecific or otherwise binds its lifetime to the originating tab.
  • Tab-switch cleanup
    Audit content-triggered chrome UI for missing dismissal handlers on tab or window focus changes, since state that survives a context switch can be misattributed to another tab.
  • Attribute-driven scoping
    Look for places relying on XUL attributes like tabspecific where the attribute is conditionally or never applied, as omitted scoping markers are a recurring source of cross-context persistence bugs.

Patch

view commit
diff --git a/toolkit/modules/ClipboardContextMenu.sys.mjs b/toolkit/modules/ClipboardContextMenu.sys.mjs
index d68e89c2530..2175da37eb5 100644
--- a/toolkit/modules/ClipboardContextMenu.sys.mjs
+++ b/toolkit/modules/ClipboardContextMenu.sys.mjs
@@ -163,6 +163,7 @@ export var ClipboardContextMenu = {
 
     let menupopup = aChromeDoc.createXULElement("menupopup");
     menupopup.id = this.MENU_POPUP_ID;
+    menupopup.setAttribute("tabspecific", "true");
     menupopup.appendChild(menuitem);
     return menupopup;
   },
Loading diff…
On This Page