CVE-2023-28159
The fullscreen notification could have been hidden on Firefox for Android by using download...
4.3 Medium
The fullscreen notification could have been hidden on Firefox for Android by using download popups, resulting in potential user confusion or spoofing attacks. <br>This bug only affects Firefox for Android. Other operating systems are unaffected.. This vulnerability affects Firefox < 111.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- None
Exploit likelihood
0.35%Up 0.3 points since Jun 3, 2023
What each source reports
NVD Score used
The fullscreen notification could have been hidden on Firefox for Android by using download popups, resulting in potential user confusion or spoofing attacks. <br>This bug only affects Firefox for Android. Other operating systems are unaffected.. This vulnerability affects Firefox < 111.
- Record
CVE-2023-28159- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N - Weakness
- CWE-1021
- Updated
- 2026-11-02
CVE List
The fullscreen notification could have been hidden on Firefox for Android by using download popups, resulting in potential user confusion or spoofing attacks. <br>This bug only affects Firefox for Android. Other operating systems are unaffected.. This vulnerability affects Firefox < 111.
- Record
CVE-2023-28159- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N - Weakness
- CWE-1021
- Updated
- 2026-11-02
EUVDEUVD-2023-31867
The fullscreen notification could have been hidden on Firefox for Android by using download popups, resulting in potential user confusion or spoofing attacks. <br>This bug only affects Firefox for Android. Other operating systems are unaffected.. This vulnerability affects Firefox < 111.
- Record
EUVD-2023-31867- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-573m-fgh4-jc94
The fullscreen notification could have been hidden on Firefox for Android by using download...
The fullscreen notification could have been hidden on Firefox for Android by using download popups, resulting in potential user confusion or spoofing attacks. <br>This bug only affects Firefox for Android. Other operating systems are unaffected.. This vulnerability affects Firefox < 111.
- Record
GHSA-573m-fgh4-jc94- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N - Weakness
- CWE-1021
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2023-28159
The fullscreen notification could have been hidden on Firefox for Android by using download popups, resulting in potential user confusion or spoofing attacks. <br>This bug only affects Firefox for Android. Other operating systems are unaffected.. This vulnerability affects Firefox < 111.
- Record
UBUNTU-CVE-2023-28159- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
OSVopenSUSE-SU-2024:12839-1 No score
MozillaFirefox-111.0.1-1.1 on GA media
These are all security issues fixed in the MozillaFirefox-111.0.1-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:12839-1- Updated
- 2026-11-02
Show 4 moreShow less
OSVopenSUSE-SU-2024:14572-1 No score
firefox-esr-128.5.1-1.1 on GA media
These are all security issues fixed in the firefox-esr-128.5.1-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:14572-1- Updated
- 2026-11-02
OSVSUSE-SU-2023:0728-1 No score
Security update for MozillaFirefox
This update for MozillaFirefox fixes the following issues:
Update to version 102.9.0 ESR (bsc#1209173):
- CVE-2023-28159: Fullscreen Notification could have been hidden by download popups on Android
- CVE-2023-25748: Fullscreen Notification could have been hidden by window prompts on Android
- CVE-2023-25749: Firefox for Android may have opened third-party apps without a prompt
- CVE-2023-25750: Potential ServiceWorker cache leak during private browsing mode
- CVE-2023-25751: Incorrect code generation during JIT compilation
- CVE-2023-28160: Redirect to Web Extension files may have leaked local path
- CVE-2023-28164: URL being dragged from a removed cross-origin iframe into the same tab triggered navigation
- CVE-2023-28161: One-time permissions granted to a local file were extended to other local files loaded in the same tab
- CVE-2023-28162: Invalid downcast in Worklets
- CVE-2023-25752: Potential out-of-bounds when accessing throttled streams
- CVE-2023-28163: Windows Save As dialog resolved environment variables
- CVE-2023-28176: Memory safety bugs fixed in Firefox 111 and Firefox ESR 102.9
- CVE-2023-28177: Memory safety bugs fixed in Firefox 111
- Record
SUSE-SU-2023:0728-1- Updated
- 2026-11-02
OSVSUSE-SU-2023:0763-1 No score
Security update for MozillaFirefox
This update for MozillaFirefox fixes the following issues:
Update to version 102.9.0 ESR (bsc#1209173):
- CVE-2023-28159: Fullscreen Notification could have been hidden by download popups on Android
- CVE-2023-25748: Fullscreen Notification could have been hidden by window prompts on Android
- CVE-2023-25749: Firefox for Android may have opened third-party apps without a prompt
- CVE-2023-25750: Potential ServiceWorker cache leak during private browsing mode
- CVE-2023-25751: Incorrect code generation during JIT compilation
- CVE-2023-28160: Redirect to Web Extension files may have leaked local path
- CVE-2023-28164: URL being dragged from a removed cross-origin iframe into the same tab triggered navigation
- CVE-2023-28161: One-time permissions granted to a local file were extended to other local files loaded in the same tab
- CVE-2023-28162: Invalid downcast in Worklets
- CVE-2023-25752: Potential out-of-bounds when accessing throttled streams
- CVE-2023-28163: Windows Save As dialog resolved environment variables
- CVE-2023-28176: Memory safety bugs fixed in Firefox 111 and Firefox ESR 102.9
- CVE-2023-28177: Memory safety bugs fixed in Firefox 111
- Record
SUSE-SU-2023:0763-1- Updated
- 2026-11-02
OSVSUSE-SU-2023:0835-1 No score
Security update for MozillaFirefox
This update for MozillaFirefox fixes the following issues:
Update to version 102.9.0 ESR (bsc#1209173):
- CVE-2023-28159: Fullscreen Notification could have been hidden by download popups on Android
- CVE-2023-25748: Fullscreen Notification could have been hidden by window prompts on Android
- CVE-2023-25749: Firefox for Android may have opened third-party apps without a prompt
- CVE-2023-25750: Potential ServiceWorker cache leak during private browsing mode
- CVE-2023-25751: Incorrect code generation during JIT compilation
- CVE-2023-28160: Redirect to Web Extension files may have leaked local path
- CVE-2023-28164: URL being dragged from a removed cross-origin iframe into the same tab triggered navigation
- CVE-2023-28161: One-time permissions granted to a local file were extended to other local files loaded in the same tab
- CVE-2023-28162: Invalid downcast in Worklets
- CVE-2023-25752: Potential out-of-bounds when accessing throttled streams
- CVE-2023-28163: Windows Save As dialog resolved environment variables
- CVE-2023-28176: Memory safety bugs fixed in Firefox 111 and Firefox ESR 102.9
- CVE-2023-28177: Memory safety bugs fixed in Firefox 111
- Record
SUSE-SU-2023:0835-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
MozillaFirefoxSUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS From an advisory covering 13 CVEs |
before 102.9.0-150000.150.79.1 | 102.9.0-150000.150.79.1 |
MozillaFirefoxSUSE:Linux Enterprise Server 15 SP1-LTSS From an advisory covering 13 CVEs |
before 102.9.0-150000.150.79.1 | 102.9.0-150000.150.79.1 |
MozillaFirefoxSUSE:Linux Enterprise Server for SAP Applications 15 SP1 From an advisory covering 13 CVEs |
before 102.9.0-150000.150.79.1 | 102.9.0-150000.150.79.1 |
MozillaFirefoxSUSE:OpenStack Cloud 9 From an advisory covering 13 CVEs |
before 102.9.0-112.153.1 | 102.9.0-112.153.1 |
MozillaFirefoxSUSE:OpenStack Cloud Crowbar 9 From an advisory covering 13 CVEs |
before 102.9.0-112.153.1 | 102.9.0-112.153.1 |
MozillaFirefoxSUSE:Linux Enterprise Server for SAP Applications 12 SP4 From an advisory covering 13 CVEs |
before 102.9.0-112.153.1 | 102.9.0-112.153.1 |
MozillaFirefoxSUSE:Linux Enterprise Software Development Kit 12 SP5 From an advisory covering 13 CVEs |
before 102.9.0-112.153.1 | 102.9.0-112.153.1 |
MozillaFirefoxSUSE:Linux Enterprise Server 12 SP2-BCL From an advisory covering 13 CVEs |
before 102.9.0-112.153.1 | 102.9.0-112.153.1 |
MozillaFirefoxSUSE:Linux Enterprise Server 12 SP4-ESPOS From an advisory covering 13 CVEs |
before 102.9.0-112.153.1 | 102.9.0-112.153.1 |
MozillaFirefoxSUSE:Linux Enterprise Server 12 SP4-LTSS From an advisory covering 13 CVEs |
before 102.9.0-112.153.1 | 102.9.0-112.153.1 |
Show 16 moreShow less
| Package | Affected | Fixed |
|---|---|---|
MozillaFirefoxSUSE:Linux Enterprise Server 12 SP5 From an advisory covering 13 CVEs |
before 102.9.0-112.153.1 | 102.9.0-112.153.1 |
MozillaFirefoxSUSE:Linux Enterprise Server for SAP Applications 12 SP5 From an advisory covering 13 CVEs |
before 102.9.0-112.153.1 | 102.9.0-112.153.1 |
MozillaFirefoxSUSE:Linux Enterprise Module for Desktop Applications 15 SP4 From an advisory covering 13 CVEs |
before 102.9.0-150200.152.81.1 | 102.9.0-150200.152.81.1 |
MozillaFirefoxSUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS From an advisory covering 13 CVEs |
before 102.9.0-150200.152.81.1 | 102.9.0-150200.152.81.1 |
MozillaFirefoxSUSE:Linux Enterprise High Performance Computing 15 SP3-ESPOS From an advisory covering 13 CVEs |
before 102.9.0-150200.152.81.1 | 102.9.0-150200.152.81.1 |
MozillaFirefoxSUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS From an advisory covering 13 CVEs |
before 102.9.0-150200.152.81.1 | 102.9.0-150200.152.81.1 |
MozillaFirefoxSUSE:Linux Enterprise Real Time 15 SP3 From an advisory covering 13 CVEs |
before 102.9.0-150200.152.81.1 | 102.9.0-150200.152.81.1 |
MozillaFirefoxSUSE:Linux Enterprise Server 15 SP2-LTSS From an advisory covering 13 CVEs |
before 102.9.0-150200.152.81.1 | 102.9.0-150200.152.81.1 |
MozillaFirefoxSUSE:Linux Enterprise Server 15 SP3-LTSS From an advisory covering 13 CVEs |
before 102.9.0-150200.152.81.1 | 102.9.0-150200.152.81.1 |
MozillaFirefoxSUSE:Linux Enterprise Server for SAP Applications 15 SP2 From an advisory covering 13 CVEs |
before 102.9.0-150200.152.81.1 | 102.9.0-150200.152.81.1 |
MozillaFirefoxSUSE:Linux Enterprise Server for SAP Applications 15 SP3 From an advisory covering 13 CVEs |
before 102.9.0-150200.152.81.1 | 102.9.0-150200.152.81.1 |
MozillaFirefoxSUSE:Enterprise Storage 7 From an advisory covering 13 CVEs |
before 102.9.0-150200.152.81.1 | 102.9.0-150200.152.81.1 |
MozillaFirefoxSUSE:Enterprise Storage 7.1 From an advisory covering 13 CVEs |
before 102.9.0-150200.152.81.1 | 102.9.0-150200.152.81.1 |
MozillaFirefoxopenSUSE:Leap 15.4 From an advisory covering 13 CVEs |
before 102.9.0-150200.152.81.1 | 102.9.0-150200.152.81.1 |
MozillaFirefoxopenSUSE:Tumbleweed From an advisory covering 13 CVEs |
before 111.0.1-1.1 | 111.0.1-1.1 |
firefox-esropenSUSE:Tumbleweed From an advisory covering 1860 CVEs |
before 128.5.1-1.1 | 128.5.1-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-28159 is a medium vulnerability (CVSS 4.3) in Mozilla Firefox, published March 14, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.35%, the 28th percentile. No source names a fixed version.
References
mozilla.org/security/advisories/mfsa2023-09
bugzilla.mozilla.org/show_bug.cgi?id=1783561
nvd.nist.gov/vuln/detail/CVE-2023-28159
github.com/advisories/GHSA-573m-fgh4-jc94
suse.com/support/update/announcement/2023/suse-su-20230728-1
bugzilla.suse.com/1209173
Show 194 moreShow less
ubuntu.com/security/CVE-2023-28159
cve.org/CVERecord?id=CVE-2023-28159
lists.opensuse.org/archives/list/[email protected]/thread/3HI2RC7AJAHY74Q6MK7GNGWU6TITB22V
This page doesn't list everything
Left out here: 1,673 references. The JSON record has them.