CVE-2022-22743

What it actually does

The vulnerability allows an attacker-controlled tab to trap the browser in fullscreen mode by abusing iframe navigation combined with a fullscreen request, bypassing the normal exit mechanism.

Why it matters to the business

Users may become unable to exit fullscreen, causing workflow disruption, increased support burden, and potential for follow-on social engineering or phishing that appears more credible while the user is stuck.

How an attack unfolds

An attacker crafts a web page containing an iframe that requests fullscreen access; when the victim navigates within or from that iframe, the browser state is left unable to exit fullscreen, leaving the tab trapped.

How to fix it

Upgrade Mozilla Firefox to version 96 or later, Firefox ESR to 91.5 or later, and Thunderbird to 91.5 or later. Apply updates through the browser's built-in update mechanism or package manager.

How to confirm the fix worked

Confirm installed versions meet or exceed Firefox 96, Firefox ESR 91.5, or Thunderbird 91.5; re-test fullscreen navigation scenarios from iframes to verify exit functionality is restored.

Typical attack path

1. Attacker hosts a malicious page embedding an iframe requesting fullscreen
2. Victim visits the page and triggers the fullscreen request
3. Navigation occurs inside or from the iframe under attacker control
4. Browser enters a state where fullscreen exit is no longer possible

How to detect it

Review browser update logs and version inventories for instances still running Firefox before 96, ESR before 91.5, or Thunderbird before 91.5; no specific post-exploitation artifacts are typically logged for this client-side issue.

What your security team should do

• Prioritize patching all Firefox, ESR, and Thunderbird instances to the fixed versions
• Enable automatic updates where possible and monitor for remaining outdated deployments
• Educate users on reporting unexpected fullscreen behavior as a potential indicator