CVE-2022-45418: medium-severity vulnerability in Mozilla Firefox
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
A custom mouse cursor defined in CSS could appear on top of browser controls, potentially tricking users into clicking the wrong buttons or thinking they're interacting with legitimate interface elements.
CWE-1021 (Improper Restriction of Rendered UI Layers or Frames) allows malicious web pages to render custom CSS cursors that overlay browser UI elements, creating a spoofing vector. The vulnerability requires user interaction with the spoofed UI area and affects Firefox/Thunderbird versions prior to specified patches, with medium severity due to reliance on user confusion for successful attack.
In the same product, most dangerous first.