CVE-2021-23976
published 2021-02-26CVE-2021-23976: When accepting a malicious intent from other installed apps, Firefox for Android accepted manifests from arbitrary file paths and allowed declaring webapp…
PriorityP337high8.1CVSS 3.1
AVNACLPRNUIRSUCHIHAN
EPSS
1.10%
62.4th percentile
When accepting a malicious intent from other installed apps, Firefox for Android accepted manifests from arbitrary file paths and allowed declaring webapp manifests for other origins. This could be used to gain fullscreen access for UI spoofing and could also lead to cross-origin attacks on targeted websites. Note: This issue is a different issue from CVE-2020-26954 and only affected Firefox for Android. Other operating systems are unaffected. This vulnerability affects Firefox < 86.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | firefox | — | — |
| mozilla | firefox | < 86.0 | 86.0 |
| mozilla | firefox | — | — |
CVSS provenance
nvdv3.18.1HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
nvdv2.05.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:N
osv4.3MEDIUM
vendor_debian4.3LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Debian
CVE-2021-23976: firefox - When accepting a malicious intent from other installed apps, Firefox for Android...
vendor_debian·2021·CVSS 4.3
CVE-2021-23976 [MEDIUM] CVE-2021-23976: firefox - When accepting a malicious intent from other installed apps, Firefox for Android...
When accepting a malicious intent from other installed apps, Firefox for Android accepted manifests from arbitrary file paths and allowed declaring webapp manifests for other origins. This could be used to gain fullscreen access for UI spoofing and could also lead to cross-origin attacks on targeted websites. Note: This issue is a different issue from CVE-2020-26954 and only affected Firefox for Android. Other operating systems are unaffected. This vulnerability affects Firefox < 86.
Scope: local
sid: resolved
Mozilla
Mozilla Foundation Security Advisory 2021-07: CVE-2021-23976
vendor_mozilla·CVSS 8.1
CVE-2021-23976 [HIGH] Mozilla Foundation Security Advisory 2021-07: CVE-2021-23976
Mozilla Foundation Security Advisory 2021-07
CVE: CVE-2021-23976
Product: Firefox
Impact: high
Fixed in: Firefox 86
GHSA
GHSA-q9m5-5m39-7whx: When accepting a malicious intent from other installed apps, Firefox for Android accepted manifests from arbitrary file paths and allowed declaring we
ghsa_unreviewed·2022-05-24·CVSS 4.3
CVE-2021-23976 [MEDIUM] CWE-1021 GHSA-q9m5-5m39-7whx: When accepting a malicious intent from other installed apps, Firefox for Android accepted manifests from arbitrary file paths and allowed declaring we
When accepting a malicious intent from other installed apps, Firefox for Android accepted manifests from arbitrary file paths and allowed declaring webapp manifests for other origins. This could be used to gain fullscreen access for UI spoofing and could also lead to cross-origin attacks on targeted websites. Note: This issue is a different issue from CVE-2020-26954 and only affected Firefox for Android. Other operating systems are unaffected. This vulnerability affects Firefox < 86.
OSV
CVE-2021-23976: When accepting a malicious intent from other installed apps, Firefox for Android accepted manifests from arbitrary file paths and allowed declaring we
osv·2021-02-26·CVSS 4.3
CVE-2021-23976 [MEDIUM] CVE-2021-23976: When accepting a malicious intent from other installed apps, Firefox for Android accepted manifests from arbitrary file paths and allowed declaring we
When accepting a malicious intent from other installed apps, Firefox for Android accepted manifests from arbitrary file paths and allowed declaring webapp manifests for other origins. This could be used to gain fullscreen access for UI spoofing and could also lead to cross-origin attacks on targeted websites. Note: This issue is a different issue from CVE-2020-26954 and only affected Firefox for Android. Other operating systems are unaffected. This vulnerability affects Firefox < 86.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://bugzilla.mozilla.org/show_bug.cgi?id=1684627https://security.gentoo.org/glsa/202104-10https://www.mozilla.org/security/advisories/mfsa2021-07/https://bugzilla.mozilla.org/show_bug.cgi?id=1684627https://security.gentoo.org/glsa/202104-10https://www.mozilla.org/security/advisories/mfsa2021-07/
2021-02-26
Published