CVE-2024-6605: 
NixOS vulnerability analysis and mitigation

Firefox Android version 128 and earlier contained a security vulnerability (CVE-2024-6605) that allowed immediate interaction with permission prompts, potentially enabling tapjacking attacks. The vulnerability was discovered by Shaheen Fazim and was fixed in Firefox 128 (Mozilla Advisory).

The vulnerability was rated as high impact and specifically affected the Android version of Firefox. The issue stemmed from the browser's handling of permission prompts, where it failed to implement proper activation delays, making it susceptible to tapjacking attacks (Mozilla Advisory, NVD). The vulnerability was assigned CWE-277 (Insecure Inherited Permissions) and received a CVSS v3.1 base score of 8.8 (HIGH) with vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (NVD).

The vulnerability could allow attackers to perform tapjacking attacks, potentially tricking users into granting permissions unintentionally. This could lead to unauthorized access to device features and sensitive information through manipulated permission prompts (Mozilla Advisory).

The vulnerability was fixed in Firefox version 128. Users of affected versions should update to Firefox 128 or later to mitigate this security risk (Mozilla Advisory).