CVEvulnerability
CVE-2021-38506
4.3 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2021-12-08
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 4.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
- CVSS 2.0 ([email protected])
- 4.3 MEDIUM — AV:N/AC:M/Au:N/C:N/I:P/A:N
- Weaknesses
- CWE-1021
Description
Through a series of navigations, Firefox could have entered fullscreen mode without notification or warning to the user. This could lead to spoofing attacks on the browser UI including phishing. This vulnerability affects Firefox < 94, Thunderbird < 91.3, and Firefox ESR < 91.3.
Affected configurations
• mozilla firefox (< 94.0)
• mozilla firefox esr (< 91.3.0)
• mozilla thunderbird (< 91.3.0)
• debian debian linux 9.0
• debian debian linux 10.0
• debian debian linux 11.0
Related
Weakness · CWE (1)
- CWE-1021 Improper Restriction of Rendered UI Layers or Frames weakness
References
- https://bugzilla.mozilla.org/show_bug.cgi?id=1730750 Issue Tracking, Permissions Required, Vendor Advisory
- https://lists.debian.org/debian-lts-announce/2021/12/msg00030.html Mailing List, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2022/01/msg00001.html Mailing List, Third Party Advisory
- https://security.gentoo.org/glsa/202202-03 Third Party Advisory
- https://security.gentoo.org/glsa/202208-14 Third Party Advisory
- https://www.debian.org/security/2021/dsa-5026 Third Party Advisory
- https://www.debian.org/security/2022/dsa-5034 Third Party Advisory
- https://www.mozilla.org/security/advisories/mfsa2021-48/ Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2021-49/ Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2021-50/ Vendor Advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=1730750 Issue Tracking, Permissions Required, Vendor Advisory
- https://lists.debian.org/debian-lts-announce/2021/12/msg00030.html Mailing List, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2022/01/msg00001.html Mailing List, Third Party Advisory
- https://security.gentoo.org/glsa/202202-03 Third Party Advisory
- https://security.gentoo.org/glsa/202208-14 Third Party Advisory
- https://www.debian.org/security/2021/dsa-5026 Third Party Advisory
- https://www.debian.org/security/2022/dsa-5034 Third Party Advisory
- https://www.mozilla.org/security/advisories/mfsa2021-48/ Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2021-49/ Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2021-50/ Vendor Advisory