There are various known sites that trap users in the browser’s fullscreen mode and force them to accept a permission request, which allows the site to send annoying push notifications, access the computer’s camera and mic, or even install a malicious extension to the browser. In order to mitigate these risks, Firefox 70 has made the following changes:
- Cancel any pending permission request when entering fullscreen mode
- Exit fullscreen when a permission request is made while in fullscreen mode
- Block add-on installations while in fullscreen mode (since Firefox 68)
It means, if you’re using the Fullscreen API for a custom video player, an immersive game or whatever, you need to make necessary permission requests before entering fullscreen mode, otherwise the user experience could be degraded.
To better inform developers, Firefox 71 and later will log a warning in the web console when a permission request or fullscreen mode is cancelled.