CVE-2023-6206

MEDIUM

Firefox < 120, Firefox ESR < 115.5.0, Thunderbird < 115.5 - Info Di...

Title source: llm

Description

The black fade animation when exiting fullscreen is roughly the length of the anti-clickjacking delay on permission prompts. It was possible to use this fact to surprise users by luring them to click where the permission grant button would be about to appear. This vulnerability affects Firefox < 120, Firefox ESR < 115.5.0, and Thunderbird < 115.5.

References (7)

[Mailing List] https://lists.debian.org/debian-lts-announce/2023/11/msg00030.html

[Issue Tracking, Permissions Required] https://bugzilla.mozilla.org/show_bug.cgi?id=1857430

[Mailing List] https://lists.debian.org/debian-lts-announce/2023/11/msg00017.html

[Third Party Advisory] https://www.debian.org/security/2023/dsa-5561

[Release Notes, Vendor Advisory] https://www.mozilla.org/security/advisories/mfsa2023-49/

[Release Notes, Vendor Advisory] https://www.mozilla.org/security/advisories/mfsa2023-50/

[Release Notes, Vendor Advisory] https://www.mozilla.org/security/advisories/mfsa2023-52/

Scores

CVSS v3 5.4

EPSS 0.0043

EPSS Percentile 62.5%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Details

CWE

CWE-1021

Status published

Products (6)

debian/debian_linux 10.0

debian/debian_linux 11.0

debian/debian_linux 12.0

mozilla/firefox < 120.0

mozilla/firefox_esr < 115.5.0

mozilla/thunderbird < 115.5

Published Nov 21, 2023

Tracked Since Feb 18, 2026