CVE-2022-29914

What it actually does

The vulnerability permits reused popups to obscure the browser's fullscreen notification UI, bypassing intended user warnings and enabling visual spoofing of browser chrome or site identity.

Why it matters to the business

Users may be tricked into interacting with malicious content while believing they are in a trusted fullscreen session, increasing risk of phishing, credential theft, or malware delivery across browser deployments.

How an attack unfolds

An attacker hosts a malicious page that requests fullscreen mode and reuses an existing popup window positioned to cover the notification bar; the user sees only attacker-controlled content and may proceed without realizing the spoof.

How to fix it

Upgrade Mozilla Firefox to version 100 or later, Firefox ESR to 91.9 or later, and Thunderbird to 91.9 or later. Enforce automatic updates where possible and audit enterprise browser policies to prevent use of outdated releases.

How to confirm the fix worked

Confirm installed browser versions meet or exceed the fixed releases listed in the advisory; test that fullscreen notifications are no longer obscured by popups on affected pages.

Typical attack path

1. Victim visits attacker-controlled website
2. Site triggers fullscreen API request while opening or reusing a popup
3. Popup is rendered over the fullscreen security notification
4. User interacts with spoofed interface believing it is legitimate browser UI
5. Attacker captures credentials or delivers payload via the deception

How to detect it

Review browser process logs, extension activity, and user reports of unexpected fullscreen behavior; correlate with web proxy or endpoint telemetry for visits to known malicious domains during fullscreen sessions.

What your security team should do

• Prioritize patching of all Firefox, ESR, and Thunderbird instances within the next patch cycle
• Enable and enforce automatic browser updates across the environment
• Educate users on recognizing potential fullscreen spoofing attempts until patches are deployed