After a website had entered fullscreen mode, it could have used a previously opened popup to obscure the notification that indicates the browser is in fullscreen mode. Combined with spoofing the browser chrome, this could have led to confusing the user about the current origin of the page and credential theft or other attacks. This vulnerability affects Firefox < 74.
Después de que un sitio web ingresó al modo de pantalla completa, podría haber usado una ventana emergente aperturada previamente para ocultar la notificación que indica que el navegador está en modo de pantalla completa. Combinado con la suplantación del navegador Chrome, esto podría haber conllevado a confundir al usuario acerca del origen actual de la página y el robo de credenciales u otros ataques. Esta vulnerabilidad afecta a Firefox versiones anteriores a 74.
Multiple security issues were discovered in Firefox. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service, spoof the URL or other browser chrome, obtain sensitive information, bypass Content Security Policy protections, or execute arbitrary code. Various other issues were also addressed.
