Mozilla Firefox HTTPS-Only Feature Clickjacking Vulnerability

A vulnerability in Mozilla Firefox's HTTPS-Only feature exception page allowed for potential clickjacking attacks. The page, which appears when a website is accessed via HTTP, did not include a delay to prevent such attacks. This flaw could have enabled an attacker to manipulate a user into accepting an exception and loading a webpage over HTTP. The vulnerability affects Firefox versions prior to 140.

Impact

Exploitation of this vulnerability could have led to unauthorized loading of webpages over HTTP, bypassing the HTTPS-Only security feature.

Remediation

Users can update to Firefox version 140 or later to address this vulnerability.