CVE-2022-22741

What it actually does

The flaw allows a popup window to become stuck in fullscreen mode after a resize operation occurs concurrently with a fullscreen request, due to improper state validation in the fullscreen handling logic.

Why it matters to the business

Users may be unable to exit fullscreen on affected browsers, leading to disrupted workflows, support tickets, and potential loss of productivity until the browser is restarted or updated.

How an attack unfolds

An attacker hosts a malicious webpage that opens a popup, initiates a fullscreen request, and performs a resize operation to trigger the state bug, leaving the popup permanently in fullscreen and preventing normal user interaction or exit.

How to fix it

Upgrade Mozilla Firefox to version 96 or later, Firefox ESR to 91.5 or later, and Thunderbird to 91.5 or later. Apply updates through the browser's built-in update mechanism or package manager.

How to confirm the fix worked

Verify installed versions meet or exceed Firefox 96, ESR 91.5, or Thunderbird 91.5; test fullscreen popup behavior on a patched instance to confirm exit functionality is restored.

Typical attack path

1. Victim visits attacker-controlled webpage
2. Script opens a popup window and requests fullscreen access
3. Attacker-controlled resize occurs during the request
4. Fullscreen exit becomes impossible due to corrupted state
5. User remains trapped until browser restart or update

How to detect it

Review browser process logs and crash reports for unexpected fullscreen state transitions; no widespread exploitation artifacts are known, so focus on user reports of stuck fullscreen windows.

What your security team should do

• Prioritize patching all Firefox, ESR, and Thunderbird instances within 30 days given the high integrity impact
• Enable automatic updates where possible across the environment
• Monitor vendor advisories for any follow-on fixes