Vulnerability · Published Dec 9, 2020 · Assigned by mozilla

CVE-2020-26964

Medium 6.8

In plain English

A medium-severity security flaw in Firefox from Mozilla. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 61% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)6.8Medium

Exploit odds (30 days)0.9%top 39.3% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

If the Remote Debugging via USB feature was enabled in Firefox for Android on an Android version prior to Android 6.0, untrusted apps could have connected to the feature and operated with the privileges of the browser to read and interact with web content. The feature was implemented as a unix domain socket, protected by the Android SELinux policy; however, SELinux was not enforced for versions prior to 6.0. This was fixed by removing the Remote Debugging via USB feature from affected devices. *Note: This issue only affected Firefox for Android. Other operating systems are unaffected.*. This vulnerability affects Firefox < 83.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Alpine:v3.20	firefox	83.0-r0	ALPINE-CVE-2020-26964
Alpine:v3.21	firefox	83.0-r0	ALPINE-CVE-2020-26964
Alpine:v3.22	firefox	83.0-r0	ALPINE-CVE-2020-26964
Alpine:v3.23	firefox	83.0-r0	ALPINE-CVE-2020-26964
Alpine:v3.21	librewolf	83.0-r0	ALPINE-CVE-2020-26964
Alpine:v3.22	librewolf	83.0-r0	ALPINE-CVE-2020-26964
Alpine:v3.23	librewolf	83.0-r0	ALPINE-CVE-2020-26964
Alpine:v3.24	librewolf	83.0-r0	ALPINE-CVE-2020-26964

Affected products (as reported)

Vendor	Product	Versions
Mozilla	Firefox	< 83

References

https://bugzilla.mozilla.org/show_bug.cgi?id=1658865 x_refsource_MISC
https://www.mozilla.org/security/advisories/mfsa2020-50/ x_refsource_CONFIRM