CVE-2022-26383

What it actually does

A popup can be resized after a fullscreen request without displaying the fullscreen notification, allowing entry into fullscreen mode without the standard user-visible indicator.

Why it matters to the business

Attackers may trick users into interacting with malicious content while the browser is in fullscreen without the expected warning, raising the chance of successful social engineering or phishing.

How an attack unfolds

An attacker crafts a webpage that triggers a fullscreen request on a popup window and then performs a resize operation that suppresses the notification, leaving the user unaware of the fullscreen state.

How to fix it

Upgrade Mozilla Firefox to version 98 or later, Firefox ESR to 91.7 or later, and Thunderbird to 91.7 or later.

How to confirm the fix worked

Verify installed browser versions against the fixed releases and confirm that fullscreen notifications appear correctly after resize operations on test pages.

Typical attack path

1. Host a malicious webpage that interacts with popup windows
2. Trigger a fullscreen request from the popup
3. Resize the popup to bypass the notification display
4. Execute actions while the browser is fullscreen without user awareness

How to detect it

Review browser history and extension logs for repeated fullscreen requests combined with popup manipulation; no specific post-exploitation artifacts are typically logged for this issue.

What your security team should do

• Prioritize browser updates across all endpoints due to the age of the vulnerability
• Enforce automatic updates for Firefox, ESR, and Thunderbird
• Review and restrict browser extensions that manipulate popups or fullscreen behavior