CVEvulnerability
CVE-2021-23976
8.1 HIGH
Official page ↗
- Status
- Modified
- Published
- 2021-02-26
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 8.1 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
- CVSS 2.0 ([email protected])
- 5.8 MEDIUM — AV:N/AC:M/Au:N/C:P/I:P/A:N
- Weaknesses
- CWE-1021
Description
When accepting a malicious intent from other installed apps, Firefox for Android accepted manifests from arbitrary file paths and allowed declaring webapp manifests for other origins. This could be used to gain fullscreen access for UI spoofing and could also lead to cross-origin attacks on targeted websites. Note: This issue is a different issue from CVE-2020-26954 and only affected Firefox for Android. Other operating systems are unaffected. This vulnerability affects Firefox < 86.
Affected configurations
• mozilla firefox (< 86.0)
Related
Weakness · CWE (1)
- CWE-1021 Improper Restriction of Rendered UI Layers or Frames weakness
References
- https://bugzilla.mozilla.org/show_bug.cgi?id=1684627 Issue Tracking, Permissions Required, Vendor Advisory
- https://security.gentoo.org/glsa/202104-10 Third Party Advisory
- https://www.mozilla.org/security/advisories/mfsa2021-07/ Release Notes, Vendor Advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=1684627 Issue Tracking, Permissions Required, Vendor Advisory
- https://security.gentoo.org/glsa/202104-10 Third Party Advisory
- https://www.mozilla.org/security/advisories/mfsa2021-07/ Release Notes, Vendor Advisory