CVE-2023-37207
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk48th percentile - higher than 48% of all known CVEs
Summary
The vulnerability allowed a website to obscure the fullscreen notification by using a URL handled by an external program, which could lead to user confusion and potential spoofing attacks.
Risk Assessment
Organizations may be at risk of attacks that exploit this vulnerability to mislead users, potentially leading to data theft or other malicious actions.
Recommendation
It is recommended to update Firefox to version 115 or newer and Thunderbird to version 102.13 or newer to mitigate the risks associated with this vulnerability.
Original NVD description (English source)
A website could have obscured the fullscreen notification by using a URL with a scheme handled by an external program, such as a mailto URL. This could have led to user confusion and possible spoofing attacks. This vulnerability affects Firefox < 115, Firefox ESR < 102.13, and Thunderbird < 102.13.