CVE-2023-6206

What it actually does

The vulnerability exploits a timing match between the black fade animation on fullscreen exit and the anti-clickjacking delay for permission prompts, enabling an attacker-controlled page to position UI elements so a user click lands on a permission grant button that appears immediately after the animation completes.

Why it matters to the business

Attackers can obtain unauthorized access to browser features such as camera, microphone, or location without explicit user intent, potentially leading to privacy breaches or further compromise of user systems across widely deployed browser and email clients.

How an attack unfolds

An attacker crafts a malicious webpage that enters fullscreen mode, times the exit animation to coincide with the permission prompt delay, and lures the user into clicking in a location that grants permissions once the button appears, bypassing intended anti-clickjacking safeguards.

How to fix it

Update Mozilla Firefox to version 120 or later, Firefox ESR to 115.5.0 or later, and Thunderbird to 115.5 or later. Apply vendor patches promptly across all affected installations and verify updates through official distribution channels.

How to confirm the fix worked

Confirm browser and email client versions meet or exceed the fixed releases listed in vendor advisories; test permission prompt behavior after fullscreen transitions in updated builds to ensure the animation-to-delay timing mismatch is resolved.

Typical attack path

1. User visits attacker-controlled webpage
2. Page triggers fullscreen mode
3. Page exits fullscreen at a moment aligned with permission prompt timing
4. User is induced to click in the expected location of the upcoming grant button
5. Permission is granted without full user awareness

How to detect it

Review browser logs and history for unexpected fullscreen transitions followed immediately by permission grants on untrusted domains; correlate with user reports of surprise permission dialogs.

What your security team should do

• Prioritize deployment of the specified browser and Thunderbird updates to all endpoints
• Monitor vendor release notes for any related follow-on fixes
• Educate users on recognizing unexpected permission prompts during web browsing