CVE-2021-43538

What it actually does

Race condition in notification handling allows an attacker to suppress the fullscreen/pointer-lock warning banner, enabling UI spoofing on affected pages.

Why it matters to the business

Low-risk spoofing attacks could trick users into performing unintended actions such as credential entry or approving malicious operations; the issue is old with minimal active exploitation pressure.

How an attack unfolds

An attacker hosts a malicious page, requests fullscreen and pointer-lock permissions, then times a race in the notification code to hide the security banner, presenting a spoofed interface to the victim.

How to fix it

Upgrade affected Mozilla products to Thunderbird 91.4.0 or later, Firefox ESR 91.4.0 or later, and Firefox 95 or later. For the listed caolan/async dependency, update to commit e1ecdbf79264f9ab488c7799f4c76996d5dca66d.

How to confirm the fix worked

Confirm product versions meet or exceed the fixed releases; review browser release notes for the notification race fix and test fullscreen/pointer-lock flows on patched builds.

Typical attack path

1. Serve a webpage that triggers fullscreen and pointer-lock requests
2. Exploit the notification race condition to suppress the warning banner
3. Display spoofed content mimicking a trusted site or dialog
4. Capture user interactions or credentials under the false interface

How to detect it

Review browser process logs and crash reports for unexpected fullscreen or pointer-lock events without corresponding notification banners; check web server access logs for repeated fullscreen API calls from the same client.

What your security team should do

• Prioritize patching browsers and Thunderbird instances to the stated fixed versions
• Monitor EPSS trend and re-evaluate if exploit maturity increases
• Add browser version checks to vulnerability scanning and endpoint management policies