CVE-2023-29533

What it actually does

The flaw allows a malicious website to suppress or obscure the browser's fullscreen notification prompt by chaining window.open calls, repeated fullscreen requests, window.name assignments, and setInterval timing to create user confusion and enable spoofing.

Why it matters to the business

Users on unpatched Mozilla browsers and Thunderbird may be tricked into granting fullscreen access to malicious content, increasing phishing risk and potential credential or data exposure; the issue has been public for over three years with minimal observed exploitation activity.

How an attack unfolds

An attacker hosts a crafted web page that opens a new window, immediately requests fullscreen, manipulates the window name, and uses timed intervals to hide the browser's security notification bar, leading the victim to believe they are interacting with a legitimate full-screen application.

How to fix it

Upgrade Mozilla Firefox to version 112 or later, Firefox ESR to 102.10 or later, Firefox for Android and Focus for Android to 112 or later, and Thunderbird to 102.10 or later; enforce automatic updates where possible and audit any pinned older versions in the environment.

How to confirm the fix worked

Confirm installed browser versions meet or exceed the fixed releases listed above; attempt reproduction of the described window.open/fullscreen/window.name/setInterval sequence in a test environment to verify the notification is no longer obscured.

Typical attack path

1. Victim visits attacker-controlled site via phishing or compromised link
2. JavaScript executes window.open combined with fullscreen API request
3. window.name and setInterval calls repeatedly obscure or dismiss the notification overlay
4. User grants fullscreen permission under false context, enabling further spoofing or clickjacking

How to detect it

Review web proxy, browser history, and endpoint process logs for repeated fullscreen API usage patterns originating from unexpected domains; correlate with user reports of unexpected full-screen behavior or missing notification bars.

What your security team should do

• Prioritize patching all affected Mozilla products within the next patch cycle given the three-year public disclosure window
• Enable automatic updates for Firefox, ESR, Focus, and Thunderbird across the fleet
• Review web-filtering and email security controls to reduce delivery of phishing links that could trigger the flaw
• Monitor EPSS trend and revisit if exploitation maturity increases