The vulnerability is a logic flaw where the fullscreen notification is prematurely hidden when a user quickly requests fullscreen again. This could allow a malicious site to masquerade as a legitimate fullscreen program and deceive the user. The issue corresponds to CWE-1021 (Resource Spoofing) and CWE-451 (Masquerading) but does not enable code execution or privilege escalation, only spoofing or phishing‑like attacks.

Mozilla Firefox and Mozilla Thunderbird products released before version 135 are affected. The flaw was fixed in Firefox 135 and Thunderbird 135, as stated in the references.

The CVSS score of 7.3 indicates high severity for potential spoofing. The EPSS score of less than 1 % shows a very low probability of exploitation in the wild, and the vulnerability is not listed in CISA’s KEV catalog. Based on the description, it is inferred that exploitation would require the victim to interact with a malicious site that requests fullscreen in rapid succession, making the defect local to the user’s browsing session and unlikely to be abused remotely. However, because spoofing can be employed in phishing campaigns, the impact could still be significant if a user is tricked into engaging with malicious full‑screen content.