CVE-2023-25743

2023-06-0217:15:11

CWE-290

[email protected]

web.nvd.nist.gov

firefox

focus

fullscreen

notification

vulnerability

malicious website spoofing

firefox esr

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

7 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

35.0%

JSON

A lack of in app notification for entering fullscreen mode could have lead to a malicious website spoofing browser chrome.<br>This bug only affects Firefox Focus. Other versions of Firefox are unaffected.. This vulnerability affects Firefox < 110 and Firefox ESR < 102.8.