CVE-2024-6608

Cursor could be moved out of the viewport using pointerlock.

State: Published
Severity: 4.3 Medium
Published: Jul 9, 2024
Updated: Oct 30, 2025
Reserved: Jul 9, 2024

Description

It was possible to move the cursor using pointerlock from an iframe. This allowed moving the cursor outside of the viewport and the Firefox window. This vulnerability affects Firefox < 128 and Thunderbird < 128.

Scores

CVSS	Score	Vector	Source
3.1	4.3 Medium	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L	CISA-ADP

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
FirefoxMozilla	before 128Affected
ThunderbirdMozilla	before 128Affected

References

https://bugzilla.mozilla.org/show_bug.cgi?id=1743329
https://www.mozilla.org/security/advisories/mfsa2024-29/
https://www.mozilla.org/security/advisories/mfsa2024-32/

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.