CVE-2023-37204

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

A website could have obscured the fullscreen notification by using an option element by introducing lag via an expensive computational function. This could have led to user confusion and possible spoofing attacks. This vulnerability affects Firefox < 115.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Affected software

Vendor	Product	Versions
Mozilla	Firefox	>= unspecified, < 115

References

https://bugzilla.mozilla.org/show_bug.cgi?id=1832195Issue Tracking, Permissions Required
https://security.gentoo.org/glsa/202401-10
https://www.mozilla.org/security/advisories/mfsa2023-22/Vendor Advisory
https://bugzilla.mozilla.org/show_bug.cgi?id=1832195Issue Tracking, Permissions Required
https://security.gentoo.org/glsa/202401-10
https://www.mozilla.org/security/advisories/mfsa2023-22/Vendor Advisory

Timeline

Published: Jul 5, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-372056.5The use of RTL Arabic characters in the address bar may have allowed for URL spoofing. This vulnerability affects Firefox < 115.CVE-2023-372066.5Uploading files which contain symlinks may have allowed an attacker to trick a user into submitting sensitive data to a malicious website. T CVE-2023-372076.5A website could have obscured the fullscreen notification by using a URL with a scheme handled by an external program, such as a mailto URL.CVE-2023-372087.8When opening Diagcab files, Firefox did not warn the user that these files may contain malicious code. This vulnerability affects Firefox < CVE-2023-372098.8A use-after-free condition existed in `NotifyOnHistoryReload` where a `LoadingSessionHistoryEntry` object was freed and a reference to that CVE-2023-37214.8The WP-EMail WordPress plugin before 2.69.1 does not sanitise and escape some of its settings, which could allow high privilege users such a CVE-2023-372106.5A website could prevent a user from exiting full-screen mode via alert and prompt calls. This could lead to user confusion and possible spo CVE-2023-372118.8Memory safety bugs present in Firefox 114, Firefox ESR 102.12, and Thunderbird 102.12. Some of these bugs showed evidence of memory corrupti CVE-2023-372128.8Memory safety bugs present in Firefox 114. Some of these bugs showed evidence of memory corruption and we presume that with enough effort so CVE-2023-372139.8Synel SYnergy Fingerprint Terminals - CWE-78: 'OS Command Injection'CVE-2023-372149.8Heights Telecom ERO1xS-Pro Dual-Band FW version BZ_ERO1XP.025.CVE-2023-372159.8JBL soundbar multibeam 5.1 - CWE-798: Use of Hard-coded Credentials