CVE-2023-25730

What it actually does

A background script can invoke requestFullscreen and then block the main thread, forcing the browser into fullscreen mode with no exit path, enabling UI spoofing.

Why it matters to the business

Users may be tricked into interacting with fake interfaces, increasing risk of phishing or credential theft; the large number of downstream dependents amplifies exposure across the ecosystem.

How an attack unfolds

An attacker delivers malicious web content that runs a background script calling requestFullscreen while blocking the main thread, keeping the browser locked in fullscreen to spoof trusted UI elements indefinitely.

How to fix it

Upgrade affected products to the fixed versions: rizinorg/rizin (GIT) fixed in d9af48b56e47afadd1a77e74c12099efd5e8e19e and rizinorg/rz-libdemangle (GIT) fixed in 51d016750e704b27ab8ace23c0f72acabca67018. Apply updates immediately given the published date and stable EPSS trend.

How to confirm the fix worked

Confirm browser or product version is at or above the fixed releases and test that fullscreen can be exited normally without indefinite lock.

Typical attack path

1. Deliver malicious webpage or extension to victim browser
2. Background script executes requestFullscreen call
3. Main thread is intentionally blocked to prevent exit
4. Browser remains in fullscreen allowing spoofed content to be presented
5. User interacts with spoofed interface believing it is legitimate

How to detect it

Inspect browser logs and process activity for unexpected fullscreen requests originating from background scripts or extensions; correlate with user reports of inability to exit fullscreen.

What your security team should do

• Prioritize patching all instances to the listed fixed commits within the next sprint
• Monitor for any new exploit maturity signals or threat actor activity
• Review web-facing applications for custom fullscreen handling that could compound the issue