Mozilla Firefox and Thunderbird Clickjacking Vulnerability in Protocol Handler Registration

A clickjacking vulnerability has been identified in Mozilla Firefox and Thunderbird. A web page could manipulate a user into unintentionally setting that site as the default handler for a custom URL protocol. This issue affects Firefox versions prior to 136, Firefox ESR versions prior to 128.8, and Thunderbird versions prior to 136 and 128.8.

Impact

Exploitation of this vulnerability could lead to unauthorized changes in the user's default protocol handler, potentially allowing malicious websites to hijack custom URL protocols.

Remediation

Users can update to Firefox 136, Firefox ESR 128.8, or Thunderbird 136 or 128.8 to address this vulnerability.