CVE-2021-38506
N/A
N/A
Summary
Through a series of navigations, Firefox could have entered fullscreen mode without notification or warning to the user. This could lead to spoofing attacks on the browser UI including phishing. This vulnerability affects Firefox < 94, Thunderbird < 91.3, and Firefox ESR < 91.3.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Mozilla | Firefox | unspecified < 94 | affected |
| Mozilla | Thunderbird | unspecified < 91.3 | affected |
| Mozilla | Firefox ESR | unspecified < 91.3 | affected |
Weaknesses
- Firefox could be coaxed into going into fullscreen mode without notification or warning
ADP Enrichment
CVE Program Container
Additional References
- https://www.mozilla.org/security/advisories/mfsa2021-49/
- https://www.mozilla.org/security/advisories/mfsa2021-50/
- https://www.mozilla.org/security/advisories/mfsa2021-48/
- https://bugzilla.mozilla.org/show_bug.cgi?id=1730750
- https://www.debian.org/security/2021/dsa-5026
- https://lists.debian.org/debian-lts-announce/2021/12/msg00030.html
- https://www.debian.org/security/2022/dsa-5034
- https://lists.debian.org/debian-lts-announce/2022/01/msg00001.html
- https://security.gentoo.org/glsa/202202-03
- https://security.gentoo.org/glsa/202208-14
References
- https://www.mozilla.org/security/advisories/mfsa2021-49/
- https://www.mozilla.org/security/advisories/mfsa2021-50/
- https://www.mozilla.org/security/advisories/mfsa2021-48/
- https://bugzilla.mozilla.org/show_bug.cgi?id=1730750
- https://www.debian.org/security/2021/dsa-5026
- https://lists.debian.org/debian-lts-announce/2021/12/msg00030.html
- https://www.debian.org/security/2022/dsa-5034
- https://lists.debian.org/debian-lts-announce/2022/01/msg00001.html
- https://security.gentoo.org/glsa/202202-03
- https://security.gentoo.org/glsa/202208-14
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.