CVE-2020-26964

published 2020-12-09

CVE-2020-26964: If the Remote Debugging via USB feature was enabled in Firefox for Android on an Android version prior to Android 6.0, untrusted apps could have connected to…

Priority P4 32 medium 6.8 CVSS 3.1

AV N AC H PR N UI R S U C H I H A N

If the Remote Debugging via USB feature was enabled in Firefox for Android on an Android version prior to Android 6.0, untrusted apps could have connected to the feature and operated with the privileges of the browser to read and interact with web content. The feature was implemented as a unix domain socket, protected by the Android SELinux policy; however, SELinux was not enforced for versions prior to 6.0. This was fixed by removing the Remote Debugging via USB feature from affected devices. *Note: This issue only affected Firefox for Android. Other operating systems are unaffected.*. This vulnerability affects Firefox < 83.

Affected

4 ranges

Vendor	Product	Version range	Fixed in
debian	firefox	—	—
mozilla	firefox	< 83	83
mozilla	firefox	< 83.0	83.0
mozilla	firefox	—	—

CVSS provenance

nvd v3.1 6.8 MEDIUM CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

nvd v2.0 4.0 MEDIUM AV:N/AC:H/Au:N/C:P/I:P/A:N

osv 6.8 MEDIUM

vendor_debian 6.8 LOW

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.