A spoofing vulnerability in the Popup Blocker component of Mozilla Firefox and Thunderbird allows attackers to deceive users, potentially facilitating further malicious activities.

The vulnerability is located in the Popup Blocker component, where a logic error enables spoofing. It is remotely exploitable (AV:N) by an unauthenticated attacker without user interaction (UI:N), directly impacting integrity (I:H).

Spoofing vulnerabilities undermine user trust and can be leveraged to conduct effective phishing or social engineering campaigns. With a CVSS score of 7.5 (High), this vulnerability poses a significant risk to organizational integrity, as users may be tricked into performing actions or providing credentials under the guise of legitimate browser popups.

Immediate Action: Update Mozilla Firefox and Mozilla Thunderbird to version 151 or later.

Proactive Monitoring: Monitor for reports of suspicious popups or unexpected browser behavior that deviates from standard user experience.

Compensating Controls: Implement organizational security awareness training to educate users on identifying spoofed browser interfaces and suspicious popups.

Public Exploit Available: No (exploit_available: unknown)

The ability to spoof browser popups is a significant security concern for user-facing applications. Administrators must mandate the update to version 151 to ensure that the Popup Blocker functions correctly and prevents attackers from successfully spoofing legitimate system or web notifications.