CVE-2021-38506: 
NixOS vulnerability analysis and mitigation

Through a series of navigations, Firefox could have entered fullscreen mode without notification or warning to the user. This vulnerability (CVE-2021-38506) affects Firefox versions < 94, Thunderbird < 91.3, and Firefox ESR < 91.3. The issue was discovered by Irvan Kurniawan and publicly disclosed in November 2021 (Mozilla Advisory).

The vulnerability is classified as a security UI spoofing issue with a CVSS v3.1 Base Score of 4.3 (Medium) with vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. The flaw stems from improper handling of fullscreen mode transitions during page navigation sequences, which could bypass the normal fullscreen security notifications (NVD).

This vulnerability could lead to spoofing attacks on the browser UI, including phishing attempts. By bypassing the fullscreen notification system, attackers could create more convincing phishing pages by hiding the browser's security indicators and native UI elements (Mozilla Advisory).

The vulnerability was fixed in Firefox 94, Firefox ESR 91.3, and Thunderbird 91.3. Users should upgrade to these versions or later to mitigate the risk. The fix involves proper handling of fullscreen state during page navigation sequences (Debian Security).