CVE-2023-37207

What it actually does

The browser fails to properly validate and sanitize URLs with external handler schemes (such as mailto:) when entering fullscreen, allowing the standard fullscreen notification UI element to be obscured or replaced.

Why it matters to the business

Users may be tricked into believing they remain in a trusted fullscreen view while interacting with attacker-controlled content, increasing risk of phishing, credential theft, or unauthorized actions that require user trust.

How an attack unfolds

An attacker hosts a malicious page that requests fullscreen mode while supplying a URL containing an external scheme; the browser renders the page without displaying the expected security notification, enabling visual spoofing of trusted interfaces.

How to fix it

Upgrade Mozilla Firefox to version 115 or later, Firefox ESR to 102.13 or later, and Thunderbird to 102.13 or later. Apply vendor patches as they become available for any downstream distributions.

How to confirm the fix worked

Confirm installed browser and mail client versions meet or exceed the fixed releases listed by Mozilla; retest fullscreen notification behavior on pages using external-scheme URLs after upgrade.

Typical attack path

1. User visits attacker-controlled website
2. Page triggers fullscreen API request combined with external-scheme URL
3. Fullscreen notification is obscured or suppressed
4. User interacts with spoofed content under false assumption of browser UI protection
5. Attacker captures input or performs social-engineering actions

How to detect it

Review browser process execution logs and any available telemetry for unexpected fullscreen API calls immediately followed by external protocol handler invocations; correlate with user reports of missing security prompts.

What your security team should do

• Prioritize browser and Thunderbird updates across all endpoints within the next patching cycle
• Enable automatic updates for Mozilla products where policy permits
• Educate users on recognizing unexpected fullscreen behavior and manually exiting fullscreen
• Monitor vendor advisories for any additional related fixes in the same product family