CVE-2025-1018: Fullscreen notification is not displayed when fullscreen is re-requested
The fullscreen notification is prematurely hidden when fullscreen is re-requested quickly by the user. This could have been leveraged to perform a potential spoofing attack. This vulnerability was fixed in Firefox 135 and Thunderbird 135.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Firefoxto a version that resolves this vulnerability.Fixed in 135 - Upgrade
Upgrade
Thunderbirdto a version that resolves this vulnerability.Fixed in 135 - Upgrade
Upgrade
ubuntu/firefoxto a version that resolves this vulnerability.Fixed in 135.0+build2-0ubuntu0.20.04.1 - Upgrade
Upgrade
ubuntu/thunderbirdto a version that resolves this vulnerability.Fixed in 1:140.7.1+build1-0ubuntu0.22.04.1 - Upgrade
Upgrade
debian/firefoxto a version that resolves this vulnerability.Fixed in 159.0-1
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2025-1018?
CVE-2025-1018 has been classified as a moderate severity vulnerability.
How do I fix CVE-2025-1018?
To fix CVE-2025-1018, users should upgrade to the latest version of Mozilla Firefox or Thunderbird.
What does CVE-2025-1018 exploit?
CVE-2025-1018 could be exploited to perform a spoofing attack due to the premature hiding of the fullscreen notification.
Who is affected by CVE-2025-1018?
CVE-2025-1018 affects Mozilla Firefox and Thunderbird versions up to 135.
What is the main issue described in CVE-2025-1018?
The main issue described in CVE-2025-1018 is that the fullscreen notification is hidden too quickly when fullscreen is requested again by the user.