CVE-2023-25730 — UI Misrepresentation / Clickjacking in Mozilla Firefox
CWE-1021 — UI Misrepresentation / ClickjackingCWE-821 — Incorrect Synchronization15 documents8 sources
Severity
5.4MEDIUMNVD
OSV8.8OSV6.5
EPSS
0.1%
top 72.10%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedJun 2
Description
A background script invoking requestFullscreen and then blocking the main thread could force the browser into fullscreen mode indefinitely, resulting in potential user confusion or spoofing attacks. This vulnerability affects Firefox < 110, Thunderbird < 102.8, and Firefox ESR < 102.8.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.5
Affected Packages9 packages
🔴Vulnerability Details
6GHSA▶
GHSA-3q42-qm7m-gp8c: A background script invoking requestFullscreen and then blocking the main thread could force the browser into fullscreen mode indefinitely, resulting↗2023-06-02
CVEList▶
CVE-2023-25730: A background script invoking requestFullscreen and then blocking the main thread could force the browser into fullscreen mode indefinitely, resulting↗2023-06-02
OSV▶
CVE-2023-25730: A background script invoking requestFullscreen and then blocking the main thread could force the browser into fullscreen mode indefinitely, resulting↗2023-06-02
📋Vendor Advisories
8Debian▶
CVE-2023-25730: firefox - A background script invoking <code>requestFullscreen</code> and then blocking th...↗2023