CVEvulnerability
CVE-2021-23999
8.8 HIGH
Official page ↗
- Status
- Modified
- Published
- 2021-06-24
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 6.8 MEDIUM — AV:N/AC:M/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-269, CWE-697
Description
If a Blob URL was loaded through some unusual user interaction, it could have been loaded by the System Principal and granted additional privileges that should not be granted to web content. This vulnerability affects Firefox ESR < 78.10, Thunderbird < 78.10, and Firefox < 88.
Affected configurations
• mozilla firefox (< 88.0)
• mozilla firefox esr (< 78.10)
• mozilla thunderbird (< 78.10)
Related
References
- https://bugzilla.mozilla.org/show_bug.cgi?id=1691153 Exploit, Issue Tracking, Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2021-14/ Release Notes, Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2021-15/ Release Notes, Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2021-16/ Release Notes, Vendor Advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=1691153 Exploit, Issue Tracking, Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2021-14/ Release Notes, Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2021-15/ Release Notes, Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2021-16/ Release Notes, Vendor Advisory