Vulnerability · Published Jun 24, 2021 · Assigned by mozilla

CVE-2021-24000

Low 3.1

In plain English

A low-severity security flaw in Firefox from Mozilla. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 49% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)3.1Low

Exploit odds (30 days)0.6%top 50.9% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

A race condition with requestPointerLock() and setTimeout() could have resulted in a user interacting with one tab when they believed they were on a separate tab. In conjunction with certain elements (such as <input type="file">) this could have led to an attack where a user was confused about the origin of the webpage and potentially disclosed information they did not intend to. This vulnerability affects Firefox < 88.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Alpine:v3.20	firefox	88.0-r0	ALPINE-CVE-2021-24000
Alpine:v3.21	firefox	88.0-r0	ALPINE-CVE-2021-24000
Alpine:v3.22	firefox	88.0-r0	ALPINE-CVE-2021-24000
Alpine:v3.23	firefox	88.0-r0	ALPINE-CVE-2021-24000
Alpine:v3.21	librewolf	88.0-r0	ALPINE-CVE-2021-24000
Alpine:v3.22	librewolf	88.0-r0	ALPINE-CVE-2021-24000
Alpine:v3.23	librewolf	88.0-r0	ALPINE-CVE-2021-24000
Alpine:v3.24	librewolf	88.0-r0	ALPINE-CVE-2021-24000
Ubuntu:22.04:LTS	mozjs78	no fix listed	UBUNTU-CVE-2021-24000

Affected products (as reported)

Vendor	Product	Versions
Mozilla	Firefox	unspecified – before 88

References

https://www.mozilla.org/security/advisories/mfsa2021-16/ x_refsource_MISC
https://bugzilla.mozilla.org/show_bug.cgi?id=1694698 x_refsource_MISC