Vulnerability · Published Apr 24, 2020 · Assigned by mozilla

CVE-2020-6828

High 7.5

In plain English

A high-severity security flaw in Firefox ESR from Mozilla. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.5% (higher than 75% of all known vulnerabilities).

Severity (CVSS NVD)7.5High

Exploit odds (30 days)1.5%top 25.5% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

A malicious Android application could craft an Intent that would have been processed by Firefox for Android and potentially result in a file overwrite in the user's profile directory. One exploitation vector for this would be to supply a user.js file providing arbitrary malicious preference values. Control of arbitrary preferences can lead to sufficient compromise such that it is generally equivalent to arbitrary code execution.<br> *Note: This issue only affects Firefox for Android. Other operating systems are unaffected.*. This vulnerability affects Firefox ESR < 68.7.

Affected products (as reported)

Vendor	Product	Versions
Mozilla	Firefox ESR	unspecified – before 68.7

References

https://www.mozilla.org/security/advisories/mfsa2020-13/ x_refsource_MISC
https://bugzilla.mozilla.org/show_bug.cgi?id=1617928 x_refsource_MISC