CVE-2023-25743 Security feature bypass in Firefox

Q: Is CVE-2023-25743 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-25743 exists.

High 7.5 Published 2 Jun 2023 Updated 9 Jan 2025

Attackers can spoof browser chrome in Firefox Focus by exploiting missing fullscreen notifications, potentially misleading users about the active page.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2023-25743?

CVE-2023-25743 is a high-severity vulnerability in Mozilla Firefox, published on 2 Jun 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A lack of in app notification for entering fullscreen mode could have lead to a malicious website spoofing browser chrome.<br>*This bug only affects Firefox Focus. Other versions of Firefox are unaffected.*. This vulnerability affects Firefox < 110 and Firefox ESR < 102.8.

Weakness: CWE-290

Which versions are affected by CVE-2023-25743?

It affects 1 product.

Products include Mozilla Firefox Focus.

How do I fix CVE-2023-25743?

Upgrade to a fixed version.

Is CVE-2023-25743 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-25743 exists.

Sources

Also known as GHSA-j7hq-xhjg-3w36.