CVE-2022-45404

What it actually does

An attacker can trigger fullscreen mode on a browser window via chained popups and window.print() calls without displaying the expected user notification prompt, enabling visual spoofing of trusted interfaces.

Why it matters to the business

Organizations face elevated risk of successful phishing or social-engineering attacks that trick users into revealing credentials or approving fraudulent actions, potentially leading to account compromise or data loss.

How an attack unfolds

An attacker crafts a web page that opens multiple popups and invokes window.print() in sequence to force a target window into fullscreen without the standard security prompt, allowing the attacker to display a spoofed login or approval interface that appears legitimate to the victim.

How to fix it

Upgrade affected Firefox ESR to 102.5 or later, Thunderbird to 102.5 or later, and Firefox to 107 or later. Apply the listed tensorflow/tensorflow GIT commit 8741e57d163a079db05a7107a7609af70931def4 where the component is in use.

How to confirm the fix worked

Confirm browser versions meet or exceed the fixed releases and test that fullscreen transitions now consistently display the user notification prompt.

Typical attack path

1. Victim visits attacker-controlled web page
2. Page opens series of popups and calls window.print() to suppress notification
3. Target window enters fullscreen without user awareness
4. Spoofed interface is displayed to capture credentials or actions
5. Attacker receives submitted data or executes further malicious actions

How to detect it

Review web proxy logs and browser telemetry for repeated popup sequences followed by fullscreen transitions without corresponding user prompts; correlate with known malicious domains if threat actor indicators emerge.

What your security team should do

• Prioritize patching all browser instances to the fixed versions within the next maintenance window
• Monitor EPSS trend and re-evaluate if exploit maturity increases
• Educate users on recognizing unexpected fullscreen behavior as a potential indicator of spoofing