Summary by Moch_Azril
A vulnerability was identified in the handling of the Full-Screen API when triggered through a contextmenu event.
When a user right-clicks a webpage element, the page can request fullscreen mode while the browser's native context menu is being displayed. Under the observed conditions, the expected fullscreen security notification may not be presented or remain visible to the user.
This behavior can create a UI-confusion condition because users may enter fullscreen mode without receiving the usual visual indication that the browser environment has changed. An attacker could potentially use this condition together with attacker-controlled fullscreen content to create convincing browser or operating-system interface spoofing, including phishing pages that imitate trusted websites or security prompts.
The issue was reproduced using a minimal proof of concept that invokes requestFullscreen() from a contextmenu event.
The affected environment and reproduction details were provided in the original submission.