Skip to main content
CVE-2023-4053VulnerabilityPublished Updated

CVE-2023-4053: Mozilla Firefox · Vulnerability

Affects Mozilla FirefoxSource CVE Database V5

0

Not known to be exploited : upgrade to 116 or 115.2 when convenient.

Data as of 26 Oct 2026, 07:57 UTC

Severity
Medium

Rated Medium by the CNA (mozilla) · No CVSS score from NVD or the CNA

EPSS
0.7% chance of exploitation in 30 days – higher than 55% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Patch
Available – fixed in 116, 115.2

Exploitation evidence

  1. Disclosed: evidence found.

    CVE published 1 Aug 2023

  2. Detectable: no evidence on record.

    No public nuclei template indexed

  3. Weaponised: no evidence on record.

    No public exploit code indexed in Metasploit or Exploit-DB

  4. Exploited in the wild: no evidence on record.

    Not in CISA KEV and no source reports exploitation

  5. Observed by OffSeq Mirage: no evidence on record.

    No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 2026-10-26.

What to do

Upgrade Mozilla Firefox to 116 or 115.2.

Affected software

ProductAffectedFixed in
Mozilla FirefoxAffected
  • <116
  • <115.2
Fixed in
  • 116
  • 115.2

AI-suggested

Mozilla has released official fixes for this vulnerability in Firefox 116 and Firefox ESR 115.2. Users and administrators should update affected Firefox and Thunderbird installations to these versions or later to remediate the issue. No additional mitigation steps are required beyond applying the official updates.

Description

CVE-2023-4053 is a moderate-impact vulnerability in Mozilla Firefox and Thunderbird where a website could obscure the full screen notification by using a URL scheme handled by an external program, such as a mailto URL. This behavior could lead to user confusion and possible spoofing attacks. The issue affects Firefox versions prior to 116, Firefox ESR prior to 115.2, and Thunderbird prior to 115.2. Mozilla has fixed this vulnerability in Firefox 116 and Firefox ESR 115.2.

References

Community reviews

Loading reviews…