CVE-2022-45408

What it actually does

The flaw permits an attacker-controlled sequence of popups that reuse the same windowName value to enter fullscreen mode while suppressing the standard browser notification prompt that normally alerts the user.

Why it matters to the business

Users may be tricked into believing they are interacting with a legitimate application or site when they are actually viewing attacker-controlled content, increasing the risk of successful social-engineering or credential-harvesting campaigns.

How an attack unfolds

An attacker crafts a web page that opens multiple pop-up windows, each reusing the identical windowName, thereby bypassing the fullscreen permission prompt; once fullscreen is achieved without visible warning the attacker can display spoofed interfaces that mimic trusted applications.

How to fix it

Upgrade Mozilla Firefox to version 107 or later, Firefox ESR to 102.5 or later, and Thunderbird to 102.5 or later. Apply the updates through the browser's built-in update mechanism or your organization's patch-management process.

How to confirm the fix worked

Verify that installed versions meet or exceed the fixed releases listed above; re-test the affected code paths with the original proof-of-concept sequences to confirm the fullscreen prompt is now displayed.

Typical attack path

1. Victim visits attacker-controlled or compromised web content
2. JavaScript opens a chain of pop-up windows that all reference the same windowName
3. Fullscreen request is issued without triggering the normal user-visible notification
4. Attacker renders spoofed UI elements inside the fullscreen window to deceive the user

How to detect it

Review web-proxy and browser telemetry logs for repeated window.open calls that share identical windowName values followed by fullscreen requests; correlate with user reports of unexpected fullscreen behavior on external sites.

What your security team should do

• Prioritize patching all Firefox, Firefox ESR, and Thunderbird instances to the fixed versions
• Enforce automatic updates where possible and monitor enterprise deployment dashboards for completion
• Educate users on recognizing unexpected fullscreen behavior even after patching