PT-2023-2074 · Mozilla+3 · Firefox For Android+3

Axel Chong + 1 · Published 2023-03-14 · Updated 2025-01-09 · CVE-2023-28159

Positive Technologies (AI Summary)

CVSS v2.0

7.6

High

Base vector

AV:N/AC:H/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Firefox for Android versions prior to 111

Description The issue is related to the fullscreen notification mode in Firefox for Android, where the lack of warnings about potentially dangerous actions when loading downloadable file popups can lead to user confusion or spoofing attacks. This can be exploited by a remote attacker to conduct spoofing attacks.

Recommendations For Firefox for Android versions prior to 111, update to version 111 or later to resolve the issue. As a temporary workaround, consider avoiding the use of downloadable file popups in fullscreen notification mode until the update is applied.

Exploit

Fix

Clickjacking

Weakness Enumeration

CWE-1021

CWE-357

Related Identifiers

ALT-PU-2023-1443

ALT-PU-2023-1817

ALT-PU-2023-5202

ALT-PU-2023-5754

ALT-PU-2023-6436

ALT-PU-2024-3614

BDU:2023-01807

CVE-2023-28159

OPENSUSE-SU-2024:12839-1

OPENSUSE-SU-2024:14572-1

SUSE-SU-2023:0728-1

SUSE-SU-2023:0763-1

SUSE-SU-2023:0835-1

Affected Products

Alt Linux

Astra Linux

Firefox For Android

Suse

References · 1882

• 🔥 https://bugzilla.mozilla.org/show_bug.cgi?id=1783561 · Exploit
• https://osv.dev/vulnerability/openSUSE-SU-2024:14572-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-28159 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-28159 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-28159 · Security Note
• https://mozilla.org/security/advisories/mfsa2023-09 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:12839-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-28159 · Vendor Advisory
• https://mozilla.org/en-US/security/advisories/mfsa2023-09 · Vendor Advisory
• https://mozilla.org/en-US/security/advisories/mfsa2023-09/#CVE-2023-28159 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2023:0728-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-28159 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2023:0835-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2023:0763-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-01807 · Security Note