CVE-2023-32205VulnerabilityPublished 2 Jun 2023Updated 27 May 2025

CVE-2023-32205: Mozilla Firefox · Browser prompts could have been obscured by popups

Affects Mozilla FirefoxSource CVE Database V5

Not known to be exploited : upgrade to 113 or 102.11 soon.

Data as of 26 Oct 2026, 06:26 UTC

Severity

High

Rated High by the CNA (mozilla) · No CVSS score from NVD or the CNA

EPSS: 0.6% chance of exploitation in 30 days – higher than 49% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Patch: Available – fixed in 113, 102.11

Exploitation evidence

Disclosed: evidence found.
CVE published 2 Jun 2023
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 2026-10-26.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade Mozilla Firefox to 113 or 102.11.

Affected software

Product	Affected	Fixed in
Mozilla Firefox	Affected <113 <102.11	Fixed in 113 102.11

AI-suggested

European organizations should prioritize updating affected Mozilla products to the fixed versions: Firefox 113 or later, Firefox ESR 102.11 or later, and Thunderbird 102.11 or later. Beyond patching, organizations should implement user awareness training focused on recognizing suspicious browser behavior and prompts, emphasizing caution when granting permissions. Deploying endpoint security solutions that monitor for anomalous browser activity or popup behavior can provide additional detection capabilities. Network-level controls such as web filtering and blocking access to known malicious sites can reduce exposure to exploit attempts. For environments where immediate patching is not feasible, configuring browser policies to restrict or disable certain types of popups or permission prompts may reduce risk. IT teams should also audit and restrict browser extensions, as malicious or vulnerable extensions could exacerbate UI spoofing risks. Finally, organizations should monitor threat intelligence feeds for any emerging exploits related to this vulnerability to respond swiftly if exploitation attempts arise.

Description

In multiple cases browser prompts could have been obscured by popups controlled by content. These could have led to potential user confusion and spoofing attacks. This vulnerability affects Firefox < 113, Firefox ESR < 102.11, and Thunderbird < 102.11.

Impact

For European organizations, this vulnerability poses a risk primarily in terms of user trust and potential unauthorized access to sensitive resources. If exploited, attackers could trick employees into granting permissions that compromise confidentiality, such as access to webcams, microphones, or location data, or to perform actions that could lead to further compromise. This could facilitate espionage, data leakage, or lateral movement within corporate networks. The impact is heightened in sectors with stringent data protection requirements, such as finance, healthcare, and government, where unauthorized access or data exfiltration could lead to regulatory penalties under GDPR and damage to reputation. Additionally, organizations relying on Thunderbird for email communications could face risks of phishing or spoofing attacks leveraging this vulnerability. While the vulnerability requires user interaction, the potential for widespread phishing campaigns exploiting this UI spoofing could increase the attack surface. The lack of known exploits in the wild suggests limited immediate risk, but the vulnerability should be addressed promptly to prevent future exploitation.

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 6 Jul 2025, 02:57 UTC

Technical details

References

Community reviews

Related threats