CVE-2023-32205

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

In multiple cases browser prompts could have been obscured by popups controlled by content. These could have led to potential user confusion and spoofing attacks. This vulnerability affects Firefox < 113, Firefox ESR < 102.11, and Thunderbird < 102.11.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Affected software

No affected versions have been published.

Timeline

Published
Jun 2, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-322066.5An out-of-bound read could have led to a crash in the RLBox Expat driver. This vulnerability affects Firefox < 113, Firefox ESR < 102.11, anCVE-2023-322078.8A missing delay in popup notifications could have made it possible for an attacker to trick a user into granting permissions. This vulnerabiCVE-2023-322085.3Service workers could reveal script base URL due to dynamic `import()`. This vulnerability affects Firefox < 113.CVE-2023-322097.5A maliciously crafted favicon could have led to an out of memory crash. This vulnerability affects Firefox < 113.CVE-2023-32215.3User enumeration vulnerability in Password Recovery plugin 1.2 version for Roundcube, which could allow a remote attacker to create a test sCVE-2023-322106.5Documents were incorrectly assuming an ordering of principal objects when ensuring we were loading an appropriately privileged principal. InCVE-2023-322116.5A type checking bug would have led to invalid code being compiled. This vulnerability affects Firefox < 113, Firefox ESR < 102.11, and ThundCVE-2023-322124.3An attacker could have positioned a `datalist` element to obscure the address bar. This vulnerability affects Firefox < 113, Firefox ESR < 1CVE-2023-322138.8When reading a file, an uninitialized value could have been used as read limit. This vulnerability affects Firefox < 113, Firefox ESR < 102.CVE-2023-322147.5Protocol handlers `ms-cxh` and `ms-cxh-full` could have been leveraged to trigger a denial of service. *Note: This attack only affects WindoCVE-2023-322158.8Mozilla developers and community members Gabriele Svelto, Andrew Osmond, Emily McDonough, Sebastian Hengst, Andrew McCreight and the MozillaCVE-2023-322169.8Mozilla developers and community members Ronald Crane, Andrew McCreight, Randell Jesup and the Mozilla Fuzzing Team reported memory safety b
CVE-2023-32205: Medium severity, CVSS 4.3 | Vulnix