CVE-2023-6211

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 120

Description The issue is related to the HTTPS-only mode in Firefox, where an attacker could trick a user into granting an HTTPS-only exception by getting them to participate in a clicking game, if the user had enabled HTTPS-only mode and was loading an insecure HTTP page. This could allow a remote attacker to conduct a clickjacking attack by exploiting errors in the user interface's information presentation.

Recommendations For versions prior to 120, update to version 120 or later to resolve the issue. As a temporary workaround, consider avoiding participation in clicking games or other interactive elements when loading insecure HTTP pages in HTTPS-only mode. Restrict access to insecure HTTP pages to minimize the risk of exploitation.