Description
Through a series of navigations, Firefox could have entered fullscreen mode without notification or warning to the user. This could lead to spoofing attacks on the browser UI including phishing. This vulnerability affects Firefox < 94, Thunderbird < 91.3, and Firefox ESR < 91.3.
References (10)
Scores
CVSS v3
4.3
EPSS
0.0087
EPSS Percentile
75.3%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Details
CWE
CWE-1021
Status
published
Products (6)
debian/debian_linux
9.0
debian/debian_linux
10.0
debian/debian_linux
11.0
mozilla/firefox
< 94.0
mozilla/firefox_esr
< 91.3.0
mozilla/thunderbird
< 91.3.0
Published
Dec 08, 2021
Tracked Since
Feb 18, 2026