CVE-2022-31738

What it actually does

An iframe can manipulate the browser's internal fullscreen state tracking upon exit, causing the UI to render attacker-controlled content in a trusted context and enabling spoofing of interface elements.

Why it matters to the business

Users may be tricked into performing unintended actions such as entering credentials or approving transactions on spoofed interfaces, increasing risk of credential theft or fraudulent activity; the issue affects widely deployed browsers with high ecosystem prevalence.

How an attack unfolds

An attacker crafts a malicious webpage embedding an iframe, lures a victim to visit it, triggers fullscreen mode, and then exits fullscreen in a sequence that leaves the browser confused about the current state, allowing the iframe to display spoofed content that appears legitimate.

How to fix it

Upgrade Mozilla Firefox to 101 or later, Firefox ESR to 91.10 or later, and Thunderbird to 91.10 or later; apply updates immediately given the 1396 days since publication and steady EPSS trend.

How to confirm the fix worked

Confirm installed browser versions meet or exceed the fixed releases; reproduce fullscreen entry/exit sequences with iframes in a test environment to verify state handling behaves correctly.

Typical attack path

1. Host malicious webpage containing specially crafted iframe
2. Social-engineer victim to load the page
3. Trigger fullscreen mode via user gesture or script
4. Exit fullscreen in a way that desynchronizes browser state
5. Display spoofed UI elements to capture user interactions

How to detect it

Examine browser history, extension activity, and any available fullscreen event logs for repeated or unexpected fullscreen transitions originating from untrusted domains; correlate with user reports of unexpected interface changes.

What your security team should do

• Deploy browser updates across all endpoints without delay
• Block known phishing domains that could host fullscreen spoofing payloads
• Include fullscreen-related UI anomalies in user security awareness training