CVE-2022-46877

What it actually does

The browser's fullscreen notification mechanism can be delayed or suppressed through crafted content, allowing a page to enter fullscreen without the expected user-visible warning.

Why it matters to the business

Users may be tricked into interacting with malicious content while believing they are on a trusted site, increasing risk of phishing or credential theft across browser deployments.

How an attack unfolds

An attacker hosts a webpage that triggers the fullscreen API in a manner that confuses the notification timing, causing the browser to omit or delay the warning so the user remains unaware of the origin change.

How to fix it

Upgrade Mozilla Firefox to version 108 or later on all affected systems; apply equivalent updates through distribution channels such as Debian package repositories when available.

How to confirm the fix worked

Confirm the installed Firefox version is 108 or higher via the browser's about:support page or package manager output; retest fullscreen notification behavior on sample pages.

Typical attack path

1. Serve a specially crafted webpage from an attacker-controlled domain
2. Lure a user to visit the page via phishing or compromised sites
3. Invoke the fullscreen API in a way that suppresses the notification
4. Display spoofed content to harvest credentials or perform social engineering

How to detect it

Review browser history and extension logs for unexpected fullscreen transitions; correlate with user reports of missing notifications; examine network logs for visits to domains associated with known phishing campaigns exploiting browser UI issues.

What your security team should do

• Prioritize browser updates across all endpoints within the next patching cycle
• Enforce automatic update policies for Firefox where possible
• Monitor vendor advisories for related browser families and schedule follow-up updates