CVE-2023-37204

What it actually does

A malicious webpage can obscure the browser fullscreen notification by rendering an option element while executing a computationally expensive function that introduces artificial lag, allowing spoofing of UI elements.

Why it matters to the business

Users may be tricked into interacting with malicious content believing it is part of the browser or a trusted site, increasing risk of phishing or unauthorized actions that could lead to data exposure or account compromise.

How an attack unfolds

An attacker hosts a webpage that requests fullscreen mode while using an option element and heavy JavaScript computation to delay the appearance of the security notification, causing user confusion about the origin of the prompt and enabling follow-on spoofing attacks.

How to fix it

Upgrade Mozilla Firefox to version 115 or later to restore proper timing and visibility of fullscreen notifications.

How to confirm the fix worked

Verify installed Firefox version is 115 or higher; confirm that fullscreen notifications appear promptly without lag on test pages exercising option elements and heavy computation.

Typical attack path

1. Host a crafted webpage that requests fullscreen access
2. Use an option element combined with an expensive computational function to induce lag
3. Trigger the fullscreen notification delay to obscure browser warnings
4. Induce user interaction under false assumptions about the interface
5. Execute spoofing or phishing actions

How to detect it

Review browser history and console logs for repeated fullscreen requests accompanied by high CPU usage from JavaScript; examine network logs for access to pages known to abuse option elements for timing attacks, though public exploitation has not been observed.

What your security team should do

• Prioritize updating all Firefox instances to version 115 or newer
• Review and enforce browser update policies across the organization
• Educate users to pay close attention to fullscreen prompts and their origins