CVE-2023-6206

The black fade animation when exiting fullscreen is roughly the length of the anti-clickjacking delay on permission prompts. It was possible to use this fact to surprise users by luring them to click where the permission grant button would be about to appear. This vulnerability affects Firefox < 120, Firefox ESR < 115.5.0, and Thunderbird < 115.5.

• CWE-1021

• https://bugzilla.mozilla.org/show_bug.cgi?id=1857430Issue Tracking, Permissions Required
• https://lists.debian.org/debian-lts-announce/2023/11/msg00017.htmlMailing List
• https://lists.debian.org/debian-lts-announce/2023/11/msg00030.html
• https://www.debian.org/security/2023/dsa-5561Third Party Advisory
• https://www.mozilla.org/security/advisories/mfsa2023-49/Release Notes, Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2023-50/Release Notes, Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2023-52/Release Notes, Vendor Advisory
• https://bugzilla.mozilla.org/show_bug.cgi?id=1857430Issue Tracking, Permissions Required
• https://lists.debian.org/debian-lts-announce/2023/11/msg00017.htmlMailing List
• https://lists.debian.org/debian-lts-announce/2023/11/msg00030.html
• https://www.debian.org/security/2023/dsa-5561Third Party Advisory
• https://www.mozilla.org/security/advisories/mfsa2023-49/Release Notes, Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2023-50/Release Notes, Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2023-52/Release Notes, Vendor Advisory

Published

Nov 21, 2023

Last Modified

Jun 17, 2026

Status

Modified

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-6200A race condition was found in the Linux Kernel. Under certai…7.5
• CVE-2023-6201Improper Neutralization of Special Elements used in an OS Co…8.8
• CVE-2023-6202Mattermost fails to perform proper authorization in the /plu…4.3
• CVE-2023-6203The Events Calendar WordPress plugin before 6.2.8.1 disclose…7.5
• CVE-2023-6204On some systems—depending on the graphics settings and drive…6.5
• CVE-2023-6205It was possible to cause the use of a MessagePort after it h…6.5
• CVE-2023-6207Ownership mismanagement led to a use-after-free in ReadableB…8.8
• CVE-2023-6208When using X11, text selected by the page using the Selectio…8.8
• CVE-2023-6209Relative URLs starting with three slashes were incorrectly p…6.5
• CVE-2023-6210When an https: web page created a pop-up from a "javascript:…6.5
• CVE-2023-6211If an attacker needed a user to load an insecure http: page …6.5
• CVE-2023-6212Memory safety bugs present in Firefox 119, Firefox ESR 115.4…8.8