Vulnerability · Published Dec 8, 2021 · Assigned by mozilla

CVE-2021-43531

Medium 4.3

In plain English

A medium-severity security flaw in Firefox from Mozilla. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 28% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)4.3Medium

Exploit odds (30 days)0.3%top 72.4% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

When a user loaded a Web Extensions context menu, the Web Extension could access the post-redirect URL of the element clicked. If the Web Extension lacked the WebRequest permission for the hosts involved in the redirect, this would be a same-origin-violation leaking data the Web Extension should have access to. This was fixed to provide the pre-redirect URL. This is related to CVE-2021-43532 but in the context of Web Extensions. This vulnerability affects Firefox < 94.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Ubuntu:22.04:LTS	firefox	94.0+build3-0ubuntu1	UBUNTU-CVE-2021-43531

Affected products (as reported)

Vendor	Product	Versions
Mozilla	Firefox	unspecified – before 94

References

https://www.mozilla.org/security/advisories/mfsa2021-48/ x_refsource_MISC
https://bugzilla.mozilla.org/show_bug.cgi?id=1659155 x_refsource_MISC