CVE-2023-29534

CriticalCVSS 9.1/10Last modified Aug 19, 2026

Description

Different techniques existed to obscure the fullscreen notification in Firefox and Focus for Android. These could have led to potential user confusion and spoofing attacks.

*This bug only affects Firefox and Focus for Android. Other versions of Firefox are unaffected.* This vulnerability affects Firefox for Android < 112 and Focus for Android < 112.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Affected software

No affected versions have been published.

Timeline

Published: Jun 19, 2023
Last modified: Aug 19, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-295356.5Following a Garbage Collector compaction, weak maps may have been accessed before they were correctly traced. This resulted in memory corrup CVE-2023-295368.8An attacker could cause the memory manager to incorrectly free a pointer that addresses attacker-controlled memory, resulting in an assertio CVE-2023-295377.5Multiple race conditions in the font initialization could have led to memory corruption and execution of attacker-controlled code. This vuln CVE-2023-295384.3Under specific circumstances a WebExtension may have received a <code>jar:file:///</code> URI instead of a <code>moz-extension:///</code> UR CVE-2023-295398.8When handling the filename directive in the Content-Disposition header, the filename would be truncated if the filename contained a NULL cha CVE-2023-29545.4Cross-site Scripting (XSS) - Stored in GitHub repository liangliangyy/djangoblog prior to master.CVE-2023-295406.1Using a redirect embedded into <code>sourceMappingUrls</code> could allow for navigation to external protocol links in sandboxed iframes wit CVE-2023-295418.8Firefox did not properly handle downloads of files ending in <code>.desktop</code>, which can be interpreted to run attacker-controlled comm CVE-2023-295429.8A newline in a filename could have been used to bypass the file extension security mechanisms that replace malicious file extensions such as CVE-2023-295438.8An attacker could have caused memory corruption and a potentially exploitable use-after-free of a pointer in a global object's debugger vect CVE-2023-295446.5If multiple instances of resource exhaustion occurred at the incorrect time, the garbage collector could have caused memory corruption and a CVE-2023-295456.5Similar to CVE-2023-28163, this time when choosing 'Save Link As', suggested filenames containing environment variable names would have reso