CVE-2023-5729

What it actually does

A malicious website can simultaneously activate browser fullscreen mode and trigger a WebAuthn authentication prompt, hiding the standard fullscreen notification UI element and enabling visual spoofing of the browser chrome or site identity.

Why it matters to the business

Users on unpatched browsers may be tricked into completing authentication on attacker-controlled sites that appear legitimate, increasing risk of credential compromise or unauthorized account access across the organization.

How an attack unfolds

An attacker crafts a webpage that requests fullscreen while also invoking a WebAuthn prompt; the overlapping UI elements obscure the browser's fullscreen warning, allowing the attacker to present a convincing fake login or authentication interface that the victim interacts with.

How to fix it

Upgrade Mozilla Firefox to version 119 or later on all endpoints; enforce automatic browser updates through enterprise policy or management tools where possible.

How to confirm the fix worked

Verify installed Firefox version is 119 or higher via about:support or management console; test that fullscreen mode now displays the expected persistent notification when WebAuthn prompts appear.

Typical attack path

1. Victim visits attacker-controlled website via phishing or compromised link
2. Page JavaScript triggers both fullscreen request and WebAuthn credential prompt
3. Fullscreen notification is visually obscured or dismissed without user notice
4. Victim completes authentication believing they are on a trusted site
5. Attacker captures WebAuthn response or session tokens for further abuse

How to detect it

Inspect browser history, download logs, and any available telemetry for visits to unknown domains immediately before WebAuthn or fullscreen-related events; review security tool alerts for unexpected fullscreen activity combined with authentication attempts.

What your security team should do

• Prioritize deployment of Firefox 119+ across all managed devices within the next patching cycle
• Enable browser auto-update policies and monitor compliance dashboards
• Educate users on verifying site authenticity during authentication flows
• Review WebAuthn usage logs for any anomalous prompt patterns post-update