CVE-2022-45404 — User Interface (UI) Misrepresentation of Critical Information in Mozilla Firefox

CWE-451 — User Interface (UI) Misrepresentation of Critical Information CWE-1021 — UI Misrepresentation / Clickjacking14 documents9 sources

Severity

6.5MEDIUMNVD

OSV8.1

EPSS

0.2%

top 61.58%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Mozilla Firefox Mozilla Firefox ESR Mozilla Thunderbird

Timeline

PublishedDec 22

Latest updateAug 30

Description

Through a series of popup and window.print() calls, an attacker can cause a window to go fullscreen without the user seeing the notification prompt, resulting in potential user confusion or spoofing attacks. This vulnerability affects Firefox ESR < 102.5, Thunderbird < 102.5, and Firefox < 107.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:NExploitability: 2.8 | Impact: 3.6

Affected Packages9 packages

▶CVEListV5mozilla/firefoxunspecified — 107

▶NVDmozilla/firefox< 107.0

▶CVEListV5mozilla/firefox_esrunspecified — 102.5

▶NVDmozilla/firefox_esr< 102.5

▶Ubuntumozilla/firefox< 107.0+build2-0ubuntu0.18.04.1+1

🔴Vulnerability Details

OSV

thunderbird vulnerabilities↗2023-02-06

▶

CVEList

CVE-2022-45404: Through a series of popup and window↗2022-12-22

▶

OSV

CVE-2022-45404: Through a series of popup and window↗2022-12-22

▶

GHSA

GHSA-547p-jx2r-224g: Through a series of popup and window↗2022-12-22

▶

OSV

firefox vulnerabilities↗2022-11-16

▶

📋Vendor Advisories

Ubuntu

Thunderbird vulnerabilities↗2023-02-06

▶

Ubuntu

Firefox vulnerabilities↗2022-11-16

▶

Red Hat

Mozilla: Fullscreen notification bypass↗2022-11-15

▶

Debian

CVE-2022-45404: firefox - Through a series of popup and <code>window.print()</code> calls, an attacker can...↗2022

▶

Mozilla

Mozilla Foundation Security Advisory 2022-47: CVE-2022-45404↗

▶

💬Community

Bugzilla

Full screen notification bypass with window.print() in Firefox for Android↗2023-08-30

▶