CVE-2023-6867

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

The timing of a button click causing a popup to disappear was approximately the same length as the anti-clickjacking delay on permission prompts. It was possible to use this fact to surprise users by luring them to click where the permission grant button would be about to appear. This vulnerability affects Firefox ESR < 115.6 and Firefox < 121.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-1021

Affected software

No affected versions have been published.

Timeline

Published: Dec 19, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-68684.3In some instances, the user-agent would allow push requests which lacked a valid VAPID even though the push manager subscription defined one CVE-2023-68696.5A `<dialog>` element could have been manipulated to paint content outside of a sandboxed iframe. This could allow untrusted content to di CVE-2023-68704.3Applications which spawn a Toast notification in a background thread may have obscured fullscreen notifications displayed by Firefox. *This CVE-2023-68714.3Under certain conditions, Firefox did not display a warning when a user attempted to navigate to a new protocol handler. This vulnerability CVE-2023-68726.5Browser tab titles were being leaked by GNOME to system logs. This could potentially expose the browsing habits of users running in a privat CVE-2023-68738.8Memory safety bugs present in Firefox 120. Some of these bugs showed evidence of memory corruption and we presume that with enough effort so CVE-2023-68747.5Prior to v7.4.0, Ember ZNet is vulnerable to a denial of service attack through manipulation of the NWK sequence number CVE-2023-68759.8The POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress is vulnerable to unau CVE-2023-68765.4The Clever Fox – One Click Website Importer by Nayra Themes plugin for WordPress is vulnerable to unauthorized modification of data due to a CVE-2023-68775.4The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Store CVE-2023-68786.5The Slick Social Share Buttons plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on CVE-2023-68799.8Increasing the resolution of video frames, while performing a multi-threaded encode, can result in a heap overflow in av1_loop_restoration_d