CVE-2021-38506 — UI Misrepresentation / Clickjacking in Mozilla Firefox
Severity
4.3MEDIUMNVD
OSV10.0OSV8.8
EPSS
0.9%
top 24.78%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedDec 8
Latest updateJan 21
Description
Through a series of navigations, Firefox could have entered fullscreen mode without notification or warning to the user. This could lead to spoofing attacks on the browser UI including phishing. This vulnerability affects Firefox < 94, Thunderbird < 91.3, and Firefox ESR < 91.3.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:NExploitability: 2.8 | Impact: 1.4
Affected Packages9 packages
Also affects: Debian Linux 10.0, 11.0, 9.0
🔴Vulnerability Details
5GHSA▶
GHSA-9wxw-f5fm-cf3j: Through a series of navigations, Firefox could have entered fullscreen mode without notification or warning to the user↗2021-12-09
OSV▶
CVE-2021-38506: Through a series of navigations, Firefox could have entered fullscreen mode without notification or warning to the user↗2021-12-08
CVEList▶
CVE-2021-38506: Through a series of navigations, Firefox could have entered fullscreen mode without notification or warning to the user↗2021-12-08