CVE-2023-25743

A lack of in app notification for entering fullscreen mode could have lead to a malicious website spoofing browser chrome.<br>*This bug only affects Firefox Focus. Other versions of Firefox are unaffected.*. This vulnerability affects Firefox < 110 and Firefox ESR < 102.8.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://bugzilla.mozilla.org/show_bug.cgi?id=1800203	Issue Tracking Permissions Required
https://www.mozilla.org/security/advisories/mfsa2023-05/	Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2023-06/	Vendor Advisory
https://bugzilla.mozilla.org/show_bug.cgi?id=1800203	Issue Tracking Permissions Required
https://www.mozilla.org/security/advisories/mfsa2023-05/	Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2023-06/	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:mozilla:firefox_focus:-:*:*:*:*:*:*:*

History

24 Oct 2026, 13:10

Type	Values Removed	Values Added
Summary		(es) La falta de una notificación en la aplicación al entrar en modo de pantalla completa podría haber permitido que un sitio web malicioso suplantara la interfaz del navegador.<br>Este error solo afecta a Firefox Focus. Otras versiones de Firefox no se ven afectadas.. Esta vulnerabilidad afecta a Firefox menor que 110 y Firefox ESR anterior a 102.8.

Information

Published : 2023-06-02 17:15

Updated : 2026-10-24 13:10

NVD link : CVE-2023-25743

Mitre link : CVE-2023-25743

CVE.ORG link : CVE-2023-25743

JSON object : View

Products Affected

mozilla

firefox_focus

CWE

CWE-290

Authentication Bypass by Spoofing

{"id": "CVE-2023-25743", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2023-25743", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-01-09T16:12:53.900025Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security@mozilla.org", "affectedData": [{"vendor": "Mozilla", "product": "Firefox", "versions": [{"status": "affected", "version": "unspecified", "lessThan": "110", "versionType": "custom"}]}, {"vendor": "Mozilla", "product": "Firefox ESR", "versions": [{"status": "affected", "version": "unspecified", "lessThan": "102.8", "versionType": "custom"}]}]}], "published": "2023-06-02T17:15:11.633", "references": [{"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1800203", "tags": ["Issue Tracking", "Permissions Required"], "source": "security@mozilla.org"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2023-05/", "tags": ["Vendor Advisory"], "source": "security@mozilla.org"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2023-06/", "tags": ["Vendor Advisory"], "source": "security@mozilla.org"}, {"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1800203", "tags": ["Issue Tracking", "Permissions Required"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2023-05/", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2023-06/", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-290"}]}], "descriptions": [{"lang": "en", "value": "A lack of in app notification for entering fullscreen mode could have lead to a malicious website spoofing browser chrome.<br>*This bug only affects Firefox Focus. Other versions of Firefox are unaffected.*. This vulnerability affects Firefox < 110 and Firefox ESR < 102.8."}, {"lang": "es", "value": "La falta de una notificaci\u00f3n en la aplicaci\u00f3n al entrar en modo de pantalla completa podr\u00eda haber permitido que un sitio web malicioso suplantara la interfaz del navegador.<br>*Este error solo afecta a Firefox Focus. Otras versiones de Firefox no se ven afectadas.*. Esta vulnerabilidad afecta a Firefox menor que 110 y Firefox ESR anterior a 102.8."}], "lastModified": "2026-10-24T13:10:00.147", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:mozilla:firefox_focus:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A33B6DCD-A1B9-46E2-A0EF-33DDBB9508D3"}], "operator": "OR"}]}], "sourceIdentifier": "security@mozilla.org"}