CVE-2023-5726

What it actually does

A website can overlay or obscure the browser's full-screen notification prompt by triggering the native file open dialog on macOS, allowing visual spoofing of security indicators without affecting other operating systems.

Why it matters to the business

Users on macOS may be tricked into granting permissions or interacting with deceptive interfaces, increasing risk of phishing or unauthorized actions that erode trust in the browser's security warnings.

How an attack unfolds

An attacker crafts a webpage that initiates a file open dialog while simultaneously requesting full-screen mode; the dialog visually masks the notification, leading the user to misinterpret the context and approve spoofed content or actions.

How to fix it

Upgrade Firefox to version 119 or later, Firefox ESR to 115.4 or later, and Thunderbird to 115.4.1 or later on macOS systems; apply vendor updates promptly as no other mitigations fully address the UI rendering flaw.

How to confirm the fix worked

Confirm browser versions meet or exceed the fixed releases listed; test affected macOS systems by visiting proof-of-concept pages that combine file dialogs with full-screen requests to verify notifications are no longer obscured.

Typical attack path

1. Attacker hosts malicious webpage targeting macOS users
2. Page triggers file open dialog combined with full-screen request
3. Full-screen notification is visually obscured
4. User is confused and interacts with spoofed elements
5. Potential follow-on phishing or permission abuse

How to detect it

Review browser process logs and macOS system logs for unexpected full-screen transitions coinciding with file dialog events; no widespread exploitation indicators are known given the low EPSS and absence from KEV.

What your security team should do

• Prioritize patching macOS endpoints running vulnerable Firefox or Thunderbird versions within standard change windows
• Monitor vendor advisories for any additional related UI issues
• Educate macOS users on verifying full-screen prompts independently of dialogs