CVE Vulnerability

CVE-2020-26954

When accepting a malicious intent from other installed apps, Firefox for Android accepted manifests from arbitrary file paths and allowed declaring webapp manifests for other origins. This could be used to gain fullscreen access for UI spoofing and could also lead to cross-origin attacks on targeted websites. *Note: This issue only affected Firefox for Android. Other operating systems are unaffected.*. This vulnerability affects Firefox < 83.

4.3 /10

CVSS v2.0 :

V3 Legend

Vector :

Exploitability : 8.6 / Impact : 2.9

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

Scope

4.3 /10

CVSS v3.0 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://www.mozilla.org/security/advisories/mfsa2020-50/ Vendor Advisory
https://bugzilla.mozilla.org/show_bug.cgi?id=1657026 Issue Tracking Permissions Required
Configurations

Configuration 1

cpe:2.3:a:mozilla:firefox:*:*:*:*:*:android:*:*
Information

Published : 2020-12-09 01:15

Updated : 2020-12-10 04:49

NVD link : CVE-2020-26954

Mitre link : CVE-2020-26954

Products Affected
No products.
CWE
NVD-CWE-Other