CVE-2022-26383: 
NixOS vulnerability analysis and mitigation

CVE-2022-26383 is a security vulnerability discovered in Mozilla Firefox, Firefox ESR, and Thunderbird that affects versions prior to Firefox 98, Firefox ESR 91.7, and Thunderbird 91.7. The vulnerability was disclosed on March 8, 2022, and was reported by security researcher Irvan Kurniawan (Mozilla Advisory, NVD).

The vulnerability occurs when resizing a popup window after requesting fullscreen access. In this scenario, the popup would not display the fullscreen notification, potentially allowing for window spoofing attacks. The issue was classified as having a high impact and required changes to window management behavior across different platforms (Mozilla Advisory).

The vulnerability could be exploited to create browser window spoofing attacks by manipulating the fullscreen notification system. This could potentially mislead users about the security context of their browsing session, as the normal fullscreen warning indicators would not be displayed (Mozilla Advisory).

The vulnerability was fixed in Firefox 98, Firefox ESR 91.7, and Thunderbird 91.7. Users should upgrade to these versions or later to receive the security fix. The fix involves modifications to ensure proper fullscreen notification display when window resize operations occur (Mozilla Advisory).