CVE-2024-4773: 
NixOS vulnerability analysis and mitigation

CVE-2024-4773 is a security vulnerability discovered in Firefox versions prior to 126, disclosed on May 14, 2024. The vulnerability affects the browser's URL bar behavior during network errors, where prior content could remain visible with a blank URL bar, potentially enabling website spoofing attacks (Mozilla Advisory).

The vulnerability occurs when a network error happens during page load, specifically when loading a page that responds with a 404 status code and 'application/octet-stream' Content-Type. The issue stems from a behavioral mismatch in response parsing and HTML renderer components, where the browser decides to perform a process switch for loading the new page due to the previous document being eligible to enter the BFCache (Mozilla Bug). The vulnerability has been assigned a low severity rating with CVSS score indicating local access and medium complexity (Rapid7).

The primary impact of this vulnerability is that it could be used to obfuscate a spoofed website. When exploited, the vulnerability allows an attacker to maintain the display of previous content while showing a blank URL bar, potentially confusing users about the source of the content they are viewing (Mozilla Advisory).

The vulnerability can be triggered through a one-click navigation to an attacker-controlled site. The exploitation involves an attacker hosting two endpoints: one for initial navigation and another for triggering the bug. The first site redirects to the second after some time, and the second site delivers a crafted response that triggers the spoofing while freezing the content (Mozilla Bug).

The vulnerability has been fixed in Firefox version 126. Users are advised to upgrade to Firefox 126 or later to receive the security fix. The fix involves checking for network errors that prevent ExternalHelperAppService before DONT_RETARGET (Mozilla Advisory, Ubuntu Security).