CVE-2023-29546

What it actually does

Screen recording during Private Browsing fails to hide the address bar and on-screen keyboard, exposing visited URLs and typed content to the recording.

Why it matters to the business

Organizations relying on private browsing for sensitive research or user activity face risk of unintentional data leakage when recordings are shared or stored, increasing compliance and reputational exposure; low exploit prevalence limits widespread impact.

How an attack unfolds

An attacker convinces a target to perform screen recording while using Private Browsing on the affected Android browser; the recording captures visible address bar and keyboard content, which the attacker then obtains through shared files or device access.

How to fix it

Upgrade Firefox for Android and Focus for Android to version 112 or later; for focus-ios, apply the fix from commit 770b09a76b5e2fb6fd0c9646733412904657dd69.

How to confirm the fix worked

Confirm browser version is 112 or newer; test screen recording in Private Browsing and verify address bar and keyboard are hidden; review release notes for the listed commit.

Typical attack path

1. Social engineer target into enabling screen recording during a private session
2. Target browses sensitive sites or enters data while recording is active
3. Address bar and keyboard remain visible in the resulting video
4. Attacker obtains the recording via file share, cloud sync, or device compromise

How to detect it

Review device screen recordings and shared video files for unexpected visibility of browser UI elements during private sessions; no remote network indicators exist.

What your security team should do

• Prioritize update of all Firefox for Android and Focus for Android instances to version 112+
• Communicate the private-browsing screen-recording behavior change to users who handle sensitive data
• Monitor EPSS and KEV status for any future increase in observed exploitation