Vulnetix
Try Vulnetix Request Demo
CVE-2021-29987 PUBLISHED

After requesting multiple permissions, and closing the first permission panel, subsequent permission panels will be displayed in a different position but still record a click in the default location, making it possible to trick a user into accepting a permission they did not want to. *This bug only affects Firefox on Linux. Other operating systems are unaffected.*. This vulnerability affects Firefox < 91 and Thunderbird < 91.

EPSS 0.31% · 54.0th percentile

Risk Scores

EPSS Score
0.31%
54.0th percentile

Affected Products

VendorProductVersions
Ubuntu:18.04:LTSfirefox0, 56.0+build6-0ubuntu1, 57.0.1+build2-0ubuntu1
Ubuntu:18.04:LTSthunderbird1:68.10.0+build1-0ubuntu0.18.04.1, 0, 1:52.4.0+build1-0ubuntu2
Ubuntu:20.04:LTSmozjs680, 68.6.0-1ubuntu1, 68.6.0-1
Ubuntu:20.04:LTSfirefox74.0+build1-0ubuntu1, 73.0+build1-0ubuntu1, 73.0+build2-0ubuntu1
Ubuntu:18.04:LTSmozjs380, 38.8.0~repack1-0ubuntu1, 38.8.0~repack1-0ubuntu4
Ubuntu:20.04:LTSthunderbird1:78.14.0+build1-0ubuntu0.20.04.1, 1:78.14.0+build1-0ubuntu0.20.04.2, 1:68.4.1+build1-0ubuntu1
Ubuntu:22.04:LTSmozjs7878.15.0-2, 78.15.0-4ubuntu1, 0
Ubuntu:20.04:LTSmozjs520, 52.9.1-1build1, 52.9.1-1ubuntu3
Ubuntu:18.04:LTSmozjs5252.9.1-0ubuntu0.18.04.1, 52.3.1-7fakesync1, 52.3.1-0ubuntu3

Timeline

References

Open in Interactive Console →