CVE-2023-25730

MEDIUM

Firefox <110, Thunderbird <102.8, Firefox ESR <102.8 - Info Disclosure

Title source: llm

Description

A background script invoking <code>requestFullscreen</code> and then blocking the main thread could force the browser into fullscreen mode indefinitely, resulting in potential user confusion or spoofing attacks. This vulnerability affects Firefox < 110, Thunderbird < 102.8, and Firefox ESR < 102.8.

References (4)

[Issue Tracking, Permissions Required, Vendor Advisory] https://bugzilla.mozilla.org/show_bug.cgi?id=1794622

[Vendor Advisory] https://www.mozilla.org/security/advisories/mfsa2023-05/

[Vendor Advisory] https://www.mozilla.org/security/advisories/mfsa2023-06/

[Vendor Advisory] https://www.mozilla.org/security/advisories/mfsa2023-07/

Scores

CVSS v3 5.4

EPSS 0.0010

EPSS Percentile 27.5%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

CISA SSVC

Vulnrichment

Exploitation poc

Automatable no

Technical Impact partial

Details

CWE

CWE-1021

Status published

Products (3)

mozilla/firefox < 110.0

mozilla/firefox_esr < 102.8

mozilla/thunderbird < 102.8

Published Jun 02, 2023

Tracked Since Feb 18, 2026