Log in Start free

Vulnerability · Published Mar 31, 2021 · Assigned by mozilla

CVE-2021-23986

Medium 6.5

In plain English

A medium-severity security flaw in Firefox from Mozilla. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 38% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)6.5Medium
Exploit odds (30 days)0.4%top 62.1% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

A malicious extension with the 'search' permission could have installed a new search engine whose favicon referenced a cross-origin URL. The response to this cross-origin request could have been read by the extension, allowing a same-origin policy bypass by the extension, which should not have cross-origin permissions. This cross-origin request was made without cookies, so the sensitive information disclosed by the violation was limited to local-network resources or resources that perform IP-based authentication. This vulnerability affects Firefox < 87.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.20firefox87.0-r0ALPINE-CVE-2021-23986
Alpine:v3.21firefox87.0-r0ALPINE-CVE-2021-23986
Alpine:v3.22firefox87.0-r0ALPINE-CVE-2021-23986
Alpine:v3.23firefox87.0-r0ALPINE-CVE-2021-23986
Alpine:v3.21librewolf87.0-r0ALPINE-CVE-2021-23986
Alpine:v3.22librewolf87.0-r0ALPINE-CVE-2021-23986
Alpine:v3.23librewolf87.0-r0ALPINE-CVE-2021-23986
Alpine:v3.24librewolf87.0-r0ALPINE-CVE-2021-23986
Ubuntu:22.04:LTSmozjs78no fix listedUBUNTU-CVE-2021-23986

Affected products (as reported)

VendorProductVersions
Mozilla Firefox unspecified – before 87

References