CVE-2023-37210

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

A website could prevent a user from exiting full-screen mode via alert and prompt calls. This could lead to user confusion and possible spoofing attacks. This vulnerability affects Firefox < 115.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-346

Affected software

Vendor	Product	Versions
Mozilla	Firefox	>= unspecified, < 115

References

https://bugzilla.mozilla.org/show_bug.cgi?id=1821886Issue Tracking, Permissions Required
https://security.gentoo.org/glsa/202401-10
https://www.mozilla.org/security/advisories/mfsa2023-22/Vendor Advisory
https://bugzilla.mozilla.org/show_bug.cgi?id=1821886Issue Tracking, Permissions Required
https://security.gentoo.org/glsa/202401-10
https://www.mozilla.org/security/advisories/mfsa2023-22/Vendor Advisory

Timeline

Published: Jul 5, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-372118.8Memory safety bugs present in Firefox 114, Firefox ESR 102.12, and Thunderbird 102.12. Some of these bugs showed evidence of memory corrupti CVE-2023-372128.8Memory safety bugs present in Firefox 114. Some of these bugs showed evidence of memory corruption and we presume that with enough effort so CVE-2023-372139.8Synel SYnergy Fingerprint Terminals - CWE-78: 'OS Command Injection'CVE-2023-372149.8Heights Telecom ERO1xS-Pro Dual-Band FW version BZ_ERO1XP.025.CVE-2023-372159.8JBL soundbar multibeam 5.1 - CWE-798: Use of Hard-coded Credentials CVE-2023-372166.5AnaSystem SensMini M4 – Using the configuration tool, an authenticated user can cause Denial of Service for the device CVE-2023-372175.3Tadiran Telecom Aeonix - CWE-204: Observable Response Discrepancy CVE-2023-372187.5Tadiran Telecom Aeonix - CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2023-372197.8Tadiran Telecom Composit - CWE-1236: Improper Neutralization of Formula Elements in a CSV File CVE-2023-37229.8An OS command injection vulnerability was found in the Avaya Aura Device Services Web application which could allow remote code execution as CVE-2023-372209.8Synel Terminals - CWE-494: Download of Code Without Integrity Check CVE-2023-372216.17Twenty BOT - CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting').