CVE-2024-1548

What it actually does

A malicious website can position a dropdown select element to visually obscure the browser's fullscreen permission notification, allowing the prompt to be accepted without the user seeing the standard security warning.

Why it matters to the business

Users may be tricked into granting fullscreen access to attacker-controlled sites, enabling phishing, spoofing, or further client-side attacks that erode trust and increase support or incident response costs.

How an attack unfolds

An attacker hosts a page that immediately requests fullscreen via the Fullscreen API while rendering a styled dropdown that overlaps the notification dialog; the user, unaware of the obscured warning, confirms the request and the attacker then controls the fullscreen view for spoofing content.

How to fix it

Upgrade Firefox to 123 or newer, Firefox ESR to 115.8 or newer, and Thunderbird to 115.8 or newer; enforce automatic browser updates via enterprise policy where possible.

How to confirm the fix worked

Verify installed browser versions against the fixed releases; test fullscreen notification visibility with a proof-of-concept page that attempts to overlay a dropdown; confirm the prompt is no longer obscured after the update.

Typical attack path

1. Host a crafted webpage that triggers the Fullscreen API request
2. Overlay a dropdown select input to hide the browser notification
3. Lure the victim to the page via phishing or compromised site
4. Obtain user confirmation without visible security context
5. Abuse fullscreen mode to display spoofed or malicious content

How to detect it

This client-side UI issue leaves no reliable server-side logs; review browser telemetry or crash reports mentioning fullscreen, and investigate user reports of unexpected full-screen behavior or spoofed login pages.

What your security team should do

• Deploy browser updates to all endpoints within the next patching cycle
• Configure enterprise policies to enforce automatic updates for Firefox and Thunderbird
• Include fullscreen-related UI behavior in user security awareness training
• Monitor help-desk reports for unexpected fullscreen or spoofing complaints