Mozilla Firefox before 47.0 and Firefox ESR 45.x before 45.2 do not ensure that the user approves the fullscreen and pointerlock settings, which allows remote attackers to cause a denial of service (UI outage), or conduct clickjacking or spoofing attacks, via a crafted web site.
Exploitability
AV:NAC:LPR:NUI:RScope
S:CImpact
C:LI:LA:H8.8/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:H