A malicious web site can enter fullscreen mode while simultaneously triggering a WebAuthn prompt. This could have obscured the fullscreen notification and could have been leveraged in a spoofing attack. This vulnerability affects Firefox < 119.
Un sitio web malicioso puede ingresar al modo de pantalla completa y al mismo tiempo activar un mensaje de WebAuthn. Esto podría haber oscurecido la notificación en pantalla completa y podría haberse aprovechado en un ataque de suplantación de identidad. Esta vulnerabilidad afecta a Firefox < 119.
This update for MozillaFirefox fixes the following issues. Updated to version 115.4.0 ESR. Fixed a potential clickjack via queued up rendering. Fixed a cross-Origin size and header leakage. Fixed unexpected errors when handling invalid cookie characters. Fixed a crash due to a large WebGL draw. Fixed an issue where WebExtensions could open arbitrary URLs. Fixed an issue where fullscreen notifications would be obscured by file the open dialog on macOS. Fixed a download protection bypass on on Windows. Fixed a crash caused by improper object tracking during GC in the JavaScript engine. Fixed an issue where fullscreen notifications would be obscured by WebAuthn prompts. Fixed multiple memory safety issues. Fixed multiple memory safety issues.
