CVE-2023-25743

The Mozilla Foundation Security Advisory describes this flaw as: A lack of in app notification for entering fullscreen mode could have lead to a malicious website spoofing browser chrome. *This bug only affects Firefox Focus. Other versions of Firefox are unaffected.*

An update that fixes 14 vulnerabilities is now available. This update for MozillaFirefox fixes the following issues. Updated to version 102.8.0 ESR. Fixed content security policy leak in violation reports using iframes. Fixed screen hijack via browser fullscreen mode. Fixed Fullscreen notification not being shown in Firefox Focus. Fixed arbitrary memory write via PKCS 12 in NSS. Fixed potential use-after-free from compartment mismatch in SpiderMonkey. Fixed invalid downcast in SVGUtils::SetupStrokeGeometry. Fixed printing on Windows which could potentially crash Firefox with some device drivers. Fixed use-after-free in mozilla::dom::ScriptLoadContext::~ScriptLoadContext. Fixed extensions opening external schemes without user knowledge. Fixed out of bounds memory write from EncodeInputStream. Fixed opening local .url files that causes unexpected network loads. Fixed tab crash by Web Crypto ImportKey. Fixed Memory safety bugs. Fixed Memory safety bugs.