User Confusion and Spoofing Risks in Firefox and Thunderbird
CVE-2023-29533

4.3MEDIUM

Key Information:

Vendor
Mozilla
Status
Firefox
Focus for Android
Firefox ESR
Firefox for Android
Vendor
CVE Published:
2 June 2023

Summary

A combination of specific JavaScript functionalities, including window.open, fullscreen requests, and setInterval methods, could allow a website to obscure fullscreen notifications. This security flaw may lead to user confusion, raising concerns about potential spoofing attacks. Affected versions include select releases of Firefox and Thunderbird prior to version 112 and 102.10 respectively.

Affected Version(s)

Firefox < 112

Firefox ESR < 102.10

Firefox for Android < 112

References

https://www.mozilla.org/security/advisories/mfsa2023-15/
https://www.mozilla.org/security/advisories/mfsa2023-14/
https://www.mozilla.org/security/advisories/mfsa2023-13/

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.