CVE-2020-12394 Other in Firefox
A local attacker could spoof the browser's location bar by manipulating focus and origin selection, misleading users about the current site.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-12394?
CVE-2020-12394 is a low-severity vulnerability in Mozilla Firefox, published on 26 May 2020. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A logic flaw in our location bar implementation could have allowed a local attacker to spoof the current location by selecting a different origin and removing focus from the input element. This vulnerability affects Firefox < 76.
Which versions are affected by CVE-2020-12394?
It affects 1 product.
Products include Mozilla Firefox.
How do I fix CVE-2020-12394?
Upgrade to a fixed version.
Is CVE-2020-12394 being exploited?
There is no known exploitation of CVE-2020-12394 in the wild and no public exploit code.
Other vulnerabilities in Mozilla Firefox
Sources
Also known as GHSA-vp98-fg4h-f354, UBUNTU-CVE-2020-12394.