CVE-2021-43538: Debian Linux

Medium severity, CVSS 4.3. EPSS: 1.2% chance of exploitation in the next 30 days.

By misusing a race in our notification code, an attacker could have forcefully hidden the notification for pages that had received full screen and pointer lock access, which could have been used for spoofing attacks. This vulnerability affects Thunderbird < 91.4.0, Firefox ESR < 91.4.0, and Firefox < 95.

Affected products

• Debian Debian Linux: version 9.0 only; version 10.0 only; version 11.0 only
• Mozilla Firefox: before 95.0 (fixed in 95.0)
• Mozilla Firefox ESR: before 91.4.0 (fixed in 91.4.0)
• Mozilla Thunderbird: before 91.4.0 (fixed in 91.4.0)

Published 2021-12-08. Last modified 2026-06-17.