CVE-2020-26962 — UI Misrepresentation / Clickjacking in Mozilla Firefox

CWE-1021 — UI Misrepresentation / Clickjacking7 documents6 sources
Severity
6.1MEDIUMNVD
EPSS
0.2%
top 55.45%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Mozilla FirefoxDebian Firefox
Timeline
PublishedDec 9
Latest updateMay 24

Description

Cross-origin iframes that contained a login form could have been recognized by the login autofill service, and populated. This could have been used in clickjacking attacks, as well as be read across partitions in dynamic first party isolation. This vulnerability affects Firefox < 83.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.7

Affected Packages5 packages

▶debiandebian/firefox< firefox 83.0-1 (sid)
▶CVEListV5mozilla/firefox< 83
▶NVDmozilla/firefox< 83.0
▶Ubuntumozilla/firefox< 83.0+build2-0ubuntu0.16.04.3+2
▶mozillamozilla/firefox

🔴Vulnerability Details

2
GHSA
GHSA-2wfq-mq88-h9xc: Cross-origin iframes that contained a login form could have been recognized by the login autofill service, and populated↗2022-05-24
▶
OSV
CVE-2020-26962: Cross-origin iframes that contained a login form could have been recognized by the login autofill service, and populated↗2020-11-17
▶

📋Vendor Advisories

4
Ubuntu
Firefox vulnerabilities↗2020-11-19
▶
Ubuntu
Firefox vulnerabilities↗2020-11-18
▶
Debian
CVE-2020-26962: firefox - Cross-origin iframes that contained a login form could have been recognized by t...↗2020
▶
Mozilla
Mozilla Foundation Security Advisory 2020-50: CVE-2020-26962↗
▶