CVE-2023-6206

MEDIUM

Firefox < 120, Firefox ESR < 115.5.0, Thunderbird < 115.5 - Info Di...

Title source: llm

Description

The black fade animation when exiting fullscreen is roughly the length of the anti-clickjacking delay on permission prompts. It was possible to use this fact to surprise users by luring them to click where the permission grant button would be about to appear. This vulnerability affects Firefox < 120, Firefox ESR < 115.5.0, and Thunderbird < 115.5.

References (7)

Core 7

Core References

Mailing List

https://lists.debian.org/debian-lts-announce/2023/11/msg00030.html

Issue Tracking, Permissions Required

https://bugzilla.mozilla.org/show_bug.cgi?id=1857430

Mailing List

https://lists.debian.org/debian-lts-announce/2023/11/msg00017.html

Third Party Advisory

https://www.debian.org/security/2023/dsa-5561

Release Notes, Vendor Advisory

https://www.mozilla.org/security/advisories/mfsa2023-49/

Release Notes, Vendor Advisory

https://www.mozilla.org/security/advisories/mfsa2023-50/

Release Notes, Vendor Advisory

https://www.mozilla.org/security/advisories/mfsa2023-52/

Scores

CVSS v3 5.4

EPSS 0.0056

EPSS Percentile 42.2%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Details

CWE

CWE-1021

Status published

Products (6)

debian/debian_linux 10.0

debian/debian_linux 11.0

debian/debian_linux 12.0

mozilla/firefox < 120.0

mozilla/firefox_esr < 115.5.0

mozilla/thunderbird < 115.5

Published Nov 21, 2023

Tracked Since Feb 18, 2026