VulnerabilityModified
CVE-2023-6867
This vulnerability affects Firefox ESR < 115.6 and Firefox < 121.
MEDIUM 6.1EPSS 0.68%
Does this matter?
Lower severity and a low EPSS score (0.68%). Track it; it rarely justifies an emergency change on its own.
Description
The timing of a button click causing a popup to disappear was approximately the same length as the anti-clickjacking delay on permission prompts. It was possible to use this fact to surprise users by luring them to click where the permission grant button would be about to appear. This vulnerability affects Firefox ESR < 115.6 and Firefox < 121.
- CVSS 3.1
- 6.1 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- EPSS
- 0.68% probability · 51th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-1021
- Affected
- mozilla/firefox · mozilla/firefox esr · debian/debian linux
- Source
- security@mozilla.org
References
- https://bugzilla.mozilla.org/show_bug.cgi?id=1863863Issue Tracking, Permissions Required
- https://lists.debian.org/debian-lts-announce/2023/12/msg00020.htmlMailing List, Third Party Advisory
- https://security.gentoo.org/glsa/202401-10Third Party Advisory
- https://www.debian.org/security/2023/dsa-5581Third Party Advisory
- https://www.mozilla.org/security/advisories/mfsa2023-54/Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2023-56/Vendor Advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=1863863Issue Tracking, Permissions Required
- https://lists.debian.org/debian-lts-announce/2023/12/msg00020.htmlMailing List, Third Party Advisory
- https://security.gentoo.org/glsa/202401-10Third Party Advisory
- https://www.debian.org/security/2023/dsa-5581Third Party Advisory
- https://www.mozilla.org/security/advisories/mfsa2023-54/Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2023-56/Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.