CVE-2023-25730

MediumCVSS 5.4/10Last modified Oct 24, 2026

Description

A background script invoking <code>requestFullscreen</code> and then blocking the main thread could force the browser into fullscreen mode indefinitely, resulting in potential user confusion or spoofing attacks. This vulnerability affects Firefox < 110, Thunderbird < 102.8, and Firefox ESR < 102.8.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-1021

Affected software

Vendor	Product	Versions
Mozilla	Firefox	>= unspecified, < 110
Mozilla	Thunderbird	>= unspecified, < 102.8
Mozilla	Firefox ESR	>= unspecified, < 102.8

References

https://bugzilla.mozilla.org/show_bug.cgi?id=1794622Issue Tracking, Permissions Required, Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2023-05/Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2023-06/Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2023-07/Vendor Advisory
https://bugzilla.mozilla.org/show_bug.cgi?id=1794622Issue Tracking, Permissions Required, Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2023-05/Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2023-06/Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2023-07/Vendor Advisory
https://bugzilla.mozilla.org/show_bug.cgi?id=1794622Issue Tracking, Permissions Required, Vendor Advisory

Timeline

Published: Jun 2, 2023
Last modified: Oct 24, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-257318.8Due to URL previews in the network panel of developer tools improperly storing URLs, query parameters could potentially be used to overwrite CVE-2023-257328.8When encoding data from an <code>inputStream</code> in <code>xpcom</code> the size of the input being encoded was not correctly calculated p CVE-2023-257337.5The return value from `gfx::SourceSurfaceSkia::Map()` wasn't being verified which could have potentially lead to a null pointer dereference.CVE-2023-257348.1After downloading a Windows <code>.url</code> shortcut from the local filesystem, an attacker could supply a remote path that would lead to CVE-2023-257358.8Cross-compartment wrappers wrapping a scripted proxy could have caused objects from other compartments to be stored in the main compartment CVE-2023-257369.8An invalid downcast from `nsHTMLDocument` to `nsIContent` could have lead to undefined behavior. This vulnerability affects Firefox < 110.CVE-2023-257378.8An invalid downcast from <code>nsTextNode</code> to <code>SVGElement</code> could have lead to undefined behavior. This vulnerability affect CVE-2023-257386.5Members of the <code>DEVMODEW</code> struct set by the printer device driver weren't being validated and could have resulted in invalid valu CVE-2023-257398.8Module load requests that failed were not being checked as to whether or not they were cancelled causing a use-after-free in <code>ScriptLoa CVE-2023-25748.8Advantech EKI-1524, EKI-1522, EKI-1521 devices through 1.21 are affected by an command injection vulnerability in the device name input fiel CVE-2023-257408.8After downloading a Windows <code>.scf</code> script from the local filesystem, an attacker could supply a remote path that would lead to un CVE-2023-257416.5When dragging and dropping an image cross-origin, the image's size could potentially be leaked. This behavior was shipped in 109 and caused