Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2023-6867

Date: December 19, 2023

The timing of a button click causing a popup to disappear was approximately the same length as the anti-clickjacking delay on permission prompts. It was possible to use this fact to surprise users by luring them to click where the permission grant button would be about to appear. This vulnerability affects Firefox ESR < 115.6 and Firefox < 121.

Severity Score

Related Resources (10)

https://www.mozilla.org/security/advisories/mfsa2023-56/
https://www.debian.org/security/2023/dsa-5581
https://nvd.nist.gov/vuln/detail/CVE-2023-6867
https://bugzilla.mozilla.org/show_bug.cgi?id=1863863
https://security-tracker.debian.org/tracker/CVE-2023-6867
https://lists.debian.org/debian-lts-announce/2023/12/msg00020.html
https://security.gentoo.org/glsa/202401-10
https://people.canonical.com/~ubuntu-security/cve/CVE-2023-6867
https://www.mozilla.org/security/advisories/mfsa2023-54/
https://www.mend.io/vulnerability-database/CVE-2023-6867

Severity Score

Weakness Type (CWE)

Improper Restriction of Rendered UI Layers or Frames

CWE-1021

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): LOW
Privileges Required (PR): NONE
User Interaction (UI): REQUIRED
Scope (S): CHANGED
Confidentiality (C): LOW
Integrity (I): LOW
Availability (A): NONE

Do you need more information?

Contact Us