CVE-2022-22746

What it actually does

A race condition in fullscreen notification handling allows bypassing the user-visible warning, enabling an unnoticed fullscreen window spoof on Windows.

Why it matters to the business

Attackers can present convincing fake interfaces to users, increasing risk of phishing or credential theft; the issue affects widely deployed browser versions across many organizations with moderate urgency due to low EPSS and no known active exploitation.

How an attack unfolds

An attacker serves a malicious web page that initiates a fullscreen request while exploiting the timing window in the notification logic to suppress the warning, resulting in a spoofed window that appears legitimate to the victim.

How to fix it

Upgrade Firefox to 96+, Firefox ESR to 91.5+, and Thunderbird to 91.5+; apply the listed fixed Linux kernel package versions such as linux (Debian:12) 6.1.7-1, linux (Ubuntu:18.04:LTS) 4.13.0-16.19, and linux (Ubuntu:24.04:LTS) 6.5.0-9.9 where applicable.

How to confirm the fix worked

Confirm updated browser and kernel versions are installed; test fullscreen notification behavior on Windows to ensure the warning appears reliably.

Typical attack path

1. Serve malicious webpage to target
2. Trigger fullscreen API call via race condition
3. Suppress notification display
4. Display spoofed content in fullscreen
5. Capture user input or actions

How to detect it

Review browser logs and user reports for unexpected fullscreen activity without notification; check for signs of social engineering campaigns leveraging spoofed windows.

What your security team should do

• Apply browser and kernel updates immediately on all affected systems
• Monitor user reports of unexpected fullscreen behavior
• Block or restrict untrusted web content pending patches