Vulnetix
Try Vulnetix Request Demo
CVE-2021-23986 PUBLISHED

A malicious extension with the 'search' permission could have installed a new search engine whose favicon referenced a cross-origin URL. The response to this cross-origin request could have been read by the extension, allowing a same-origin policy bypass by the extension, which should not have cross-origin permissions. This cross-origin request was made without cookies, so the sensitive information disclosed by the violation was limited to local-network resources or resources that perform IP-based authentication. This vulnerability affects Firefox < 87.

EPSS 0.05% · 16.6th percentile

Risk Scores

EPSS Score
0.05%
16.6th percentile

Affected Products

VendorProductVersions
Ubuntu:22.04:LTSmozjs7878.15.0-4ubuntu1, 78.15.0-2, 78.13.0-1
Ubuntu:20.04:LTSmozjs520, 52.9.1-1ubuntu3, 52.9.1-1build1
Ubuntu:18.04:LTSfirefox86.0+build3-0ubuntu0.18.04.1, 85.0.1+build1-0ubuntu0.18.04.1, *
Ubuntu:20.04:LTSfirefox82.0+build2-0ubuntu0.20.04.1, 0, 69.0.3+build1-0ubuntu1
Ubuntu:16.04:LTSfirefox69.0.2+build1-0ubuntu0.16.04.1, 69.0+build2-0ubuntu0.16.04.4, 68.0.2+build1-0ubuntu0.16.04.1
Ubuntu:18.04:LTSmozjs3838.8.0~repack1-0ubuntu1, 38.8.0~repack1-0ubuntu3, 38.8.0~repack1-0ubuntu4
Ubuntu:18.04:LTSmozjs5252.8.1-0ubuntu0.18.04.1, 0, 52.3.1-0ubuntu3
Ubuntu:20.04:LTSmozjs68*, 0, 68.5.0-2~fakesync

Timeline

References

Open in Interactive Console →