CVEvulnerability
CVE-2023-6206
5.4 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2023-11-21
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 5.4 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
- Weaknesses
- CWE-1021
Description
The black fade animation when exiting fullscreen is roughly the length of the anti-clickjacking delay on permission prompts. It was possible to use this fact to surprise users by luring them to click where the permission grant button would be about to appear. This vulnerability affects Firefox < 120, Firefox ESR < 115.5.0, and Thunderbird < 115.5.
Affected configurations
• mozilla firefox (< 120.0)
• mozilla firefox esr (< 115.5.0)
• mozilla thunderbird (< 115.5)
• debian debian linux 10.0
• debian debian linux 11.0
• debian debian linux 12.0
Related
Weakness · CWE (1)
- CWE-1021 Improper Restriction of Rendered UI Layers or Frames weakness
References
- https://bugzilla.mozilla.org/show_bug.cgi?id=1857430 Issue Tracking, Permissions Required
- https://lists.debian.org/debian-lts-announce/2023/11/msg00017.html Mailing List
- https://lists.debian.org/debian-lts-announce/2023/11/msg00030.html lists.debian.org
- https://www.debian.org/security/2023/dsa-5561 Third Party Advisory
- https://www.mozilla.org/security/advisories/mfsa2023-49/ Release Notes, Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2023-50/ Release Notes, Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2023-52/ Release Notes, Vendor Advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=1857430 Issue Tracking, Permissions Required
- https://lists.debian.org/debian-lts-announce/2023/11/msg00017.html Mailing List
- https://lists.debian.org/debian-lts-announce/2023/11/msg00030.html lists.debian.org
- https://www.debian.org/security/2023/dsa-5561 Third Party Advisory
- https://www.mozilla.org/security/advisories/mfsa2023-49/ Release Notes, Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2023-50/ Release Notes, Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2023-52/ Release Notes, Vendor Advisory