CVE-2022-29914 — UI Misrepresentation / Clickjacking in Mozilla Firefox
Severity
6.5MEDIUMNVD
OSV4.3
EPSS
0.2%
top 52.67%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedDec 22
Description
When reusing existing popups Firefox would have allowed them to cover the fullscreen notification UI, which could have enabled browser spoofing attacks. This vulnerability affects Thunderbird < 91.9, Firefox ESR < 91.9, and Firefox < 100.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:NExploitability: 2.8 | Impact: 3.6
Affected Packages8 packages
🔴Vulnerability Details
4OSV▶
CVE-2022-29914: When reusing existing popups Firefox would have allowed them to cover the fullscreen notification UI, which could have enabled browser spoofing attack↗2022-12-22
CVEList▶
CVE-2022-29914: When reusing existing popups Firefox would have allowed them to cover the fullscreen notification UI, which could have enabled browser spoofing attack↗2022-12-22
GHSA▶
GHSA-wmwv-wgqw-75xr: When reusing existing popups Firefox would have allowed them to cover the fullscreen notification UI, which could have enabled browser spoofing attack↗2022-12-22
📋Vendor Advisories
7Debian▶
CVE-2022-29914: firefox - When reusing existing popups Firefox would have allowed them to cover the fullsc...↗2022