CVE-2020-26954
published 2020-12-09CVE-2020-26954: When accepting a malicious intent from other installed apps, Firefox for Android accepted manifests from arbitrary file paths and allowed declaring webapp…
PriorityP421medium4.3CVSS 3.1
AVNACLPRNUIRSUCNILAN
EPSS
0.63%
46.9th percentile
When accepting a malicious intent from other installed apps, Firefox for Android accepted manifests from arbitrary file paths and allowed declaring webapp manifests for other origins. This could be used to gain fullscreen access for UI spoofing and could also lead to cross-origin attacks on targeted websites. *Note: This issue only affected Firefox for Android. Other operating systems are unaffected.*. This vulnerability affects Firefox < 83.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | firefox | — | — |
| mozilla | firefox | < 86 | 86 |
| mozilla | firefox | < 83.0 | 83.0 |
| mozilla | firefox | < 86.0 | 86.0 |
| mozilla | firefox | — | — |
CVSS provenance
nvdv3.14.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
osv4.3MEDIUM
vendor_debian4.3LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-q9m5-5m39-7whx: When accepting a malicious intent from other installed apps, Firefox for Android accepted manifests from arbitrary file paths and allowed declaring we
ghsa_unreviewed·2022-05-24·CVSS 4.3
CVE-2021-23976 [MEDIUM] CWE-1021 GHSA-q9m5-5m39-7whx: When accepting a malicious intent from other installed apps, Firefox for Android accepted manifests from arbitrary file paths and allowed declaring we
When accepting a malicious intent from other installed apps, Firefox for Android accepted manifests from arbitrary file paths and allowed declaring webapp manifests for other origins. This could be used to gain fullscreen access for UI spoofing and could also lead to cross-origin attacks on targeted websites. Note: This issue is a different issue from CVE-2020-26954 and only affected Firefox for Android. Other operating systems are unaffected. This vulnerability affects Firefox < 86.
GHSA
GHSA-crcc-3c88-jfqc: When accepting a malicious intent from other installed apps, Firefox for Android accepted manifests from arbitrary file paths and allowed declaring we
ghsa_unreviewed·2022-05-24
CVE-2020-26954 [MEDIUM] GHSA-crcc-3c88-jfqc: When accepting a malicious intent from other installed apps, Firefox for Android accepted manifests from arbitrary file paths and allowed declaring we
When accepting a malicious intent from other installed apps, Firefox for Android accepted manifests from arbitrary file paths and allowed declaring webapp manifests for other origins. This could be used to gain fullscreen access for UI spoofing and could also lead to cross-origin attacks on targeted websites. *Note: This issue only affected Firefox for Android. Other operating systems are unaffected.*. This vulnerability affects Firefox < 83.
OSV
CVE-2021-23976: When accepting a malicious intent from other installed apps, Firefox for Android accepted manifests from arbitrary file paths and allowed declaring we
osv·2021-02-26·CVSS 4.3
CVE-2021-23976 [MEDIUM] CVE-2021-23976: When accepting a malicious intent from other installed apps, Firefox for Android accepted manifests from arbitrary file paths and allowed declaring we
When accepting a malicious intent from other installed apps, Firefox for Android accepted manifests from arbitrary file paths and allowed declaring webapp manifests for other origins. This could be used to gain fullscreen access for UI spoofing and could also lead to cross-origin attacks on targeted websites. Note: This issue is a different issue from CVE-2020-26954 and only affected Firefox for Android. Other operating systems are unaffected. This vulnerability affects Firefox < 86.
OSV
CVE-2020-26954: When accepting a malicious intent from other installed apps, Firefox for Android accepted manifests from arbitrary file paths and allowed declaring we
osv·2020-12-09·CVSS 4.3
CVE-2020-26954 [MEDIUM] CVE-2020-26954: When accepting a malicious intent from other installed apps, Firefox for Android accepted manifests from arbitrary file paths and allowed declaring we
When accepting a malicious intent from other installed apps, Firefox for Android accepted manifests from arbitrary file paths and allowed declaring webapp manifests for other origins. This could be used to gain fullscreen access for UI spoofing and could also lead to cross-origin attacks on targeted websites. *Note: This issue only affected Firefox for Android. Other operating systems are unaffected.*. This vulnerability affects Firefox < 83.
Debian
CVE-2021-23976: firefox - When accepting a malicious intent from other installed apps, Firefox for Android...
vendor_debian·2021·CVSS 4.3
CVE-2021-23976 [MEDIUM] CVE-2021-23976: firefox - When accepting a malicious intent from other installed apps, Firefox for Android...
When accepting a malicious intent from other installed apps, Firefox for Android accepted manifests from arbitrary file paths and allowed declaring webapp manifests for other origins. This could be used to gain fullscreen access for UI spoofing and could also lead to cross-origin attacks on targeted websites. Note: This issue is a different issue from CVE-2020-26954 and only affected Firefox for Android. Other operating systems are unaffected. This vulnerability affects Firefox < 86.
Scope: local
sid: resolved
Debian
CVE-2020-26954: firefox - When accepting a malicious intent from other installed apps, Firefox for Android...
vendor_debian·2020·CVSS 4.3
CVE-2020-26954 [MEDIUM] CVE-2020-26954: firefox - When accepting a malicious intent from other installed apps, Firefox for Android...
When accepting a malicious intent from other installed apps, Firefox for Android accepted manifests from arbitrary file paths and allowed declaring webapp manifests for other origins. This could be used to gain fullscreen access for UI spoofing and could also lead to cross-origin attacks on targeted websites. *Note: This issue only affected Firefox for Android. Other operating systems are unaffected.*. This vulnerability affects Firefox < 83.
Scope: local
sid: resolved
Mozilla
Mozilla Foundation Security Advisory 2020-50: CVE-2020-26954
vendor_mozilla·CVSS 4.3
CVE-2020-26954 [MEDIUM] Mozilla Foundation Security Advisory 2020-50: CVE-2020-26954
Mozilla Foundation Security Advisory 2020-50
CVE: CVE-2020-26954
Product: Firefox
Impact: high
Fixed in: Firefox 83
Mozilla
Mozilla Foundation Security Advisory 2021-07: CVE-2020-26954
vendor_mozilla·CVSS 4.3
CVE-2020-26954 [MEDIUM] Mozilla Foundation Security Advisory 2021-07: CVE-2020-26954
Mozilla Foundation Security Advisory 2021-07
CVE: CVE-2020-26954
Product: Firefox
Impact: high
Fixed in: Firefox 86
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2020-12-09
Published