Уязвимость сокрытия уведомлений о доступе к режиму полного экрана и захвату указателя мыши в Mozilla Firefox и Thunderbird
Описание
Злоумышленник использует уязвимость гонки в нашем коде уведомлений, чтобы принудительно скрыть уведомление для страниц, которые получают доступ к режиму полного экрана и захвату указателя. Это может использоваться для атак спуфинга.
Затронутые версии ПО
- Thunderbird версии до 91.4.0
- Firefox ESR версии до 91.4.0
- Firefox версии до 95
Тип уязвимости
Спуфинг
Ссылки
- Issue TrackingPermissions RequiredVendor Advisory
- Mailing ListThird Party Advisory
- Mailing ListThird Party Advisory
- Third Party Advisory
- Third Party Advisory
- Third Party Advisory
- Third Party Advisory
- Vendor Advisory
- Vendor Advisory
- Vendor Advisory
- Issue TrackingPermissions RequiredVendor Advisory
- Mailing ListThird Party Advisory
- Mailing ListThird Party Advisory
- Third Party Advisory
- Third Party Advisory
- Third Party Advisory
- Third Party Advisory
- Vendor Advisory
- Vendor Advisory
- Vendor Advisory
Уязвимые конфигурации
Одно из
Одно из
EPSS
4.3 Medium
CVSS3
4.3 Medium
CVSS2
Дефекты
Связанные уязвимости
By misusing a race in our notification code, an attacker could have forcefully hidden the notification for pages that had received full screen and pointer lock access, which could have been used for spoofing attacks. This vulnerability affects Thunderbird < 91.4.0, Firefox ESR < 91.4.0, and Firefox < 95.
By misusing a race in our notification code, an attacker could have forcefully hidden the notification for pages that had received full screen and pointer lock access, which could have been used for spoofing attacks. This vulnerability affects Thunderbird < 91.4.0, Firefox ESR < 91.4.0, and Firefox < 95.
By misusing a race in our notification code, an attacker could have fo ...
By misusing a race in our notification code, an attacker could have forcefully hidden the notification for pages that had received full screen and pointer lock access, which could have been used for spoofing attacks. This vulnerability affects Thunderbird < 91.4.0, Firefox ESR < 91.4.0, and Firefox < 95.
Уязвимость браузера Mozilla Firefox и почтового клиента Mozilla Thunderbird, связанная с ошибками криптографических преобразований, позволяющая нарушителю проводить спуфинг-атаки
EPSS
4.3 Medium
CVSS3
4.3 Medium
CVSS2