CVE-2020-26954 Other in Firefox
Firefox for Android allowed malicious apps to spoof UI and perform cross-origin attacks via arbitrary manifest paths, requiring an upgrade to mitigate.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2020-26954?
CVE-2020-26954 is a medium-severity vulnerability in Mozilla Firefox Mobile, published on 9 Dec 2020. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
When accepting a malicious intent from other installed apps, Firefox for Android accepted manifests from arbitrary file paths and allowed declaring webapp manifests for other origins. This could be used to gain fullscreen access for UI spoofing and could also lead to cross-origin attacks on targeted websites. *Note: This issue only affected Firefox for Android. Other operating systems are unaffected.*. This vulnerability affects Firefox < 83.
Which versions are affected by CVE-2020-26954?
It affects 1 product.
Products include Mozilla Firefox Mobile.
How do I fix CVE-2020-26954?
Upgrade to a fixed version.
Is CVE-2020-26954 being exploited?
There is no known exploitation of CVE-2020-26954 in the wild and no public exploit code.
Other vulnerabilities in Mozilla Firefox Mobile
Sources
Also known as GHSA-crcc-3c88-jfqc, UBUNTU-CVE-2020-26954.