CVE-2020-26955 Information disclosure in Firefox
Firefox for Android leaks cookies between private and normal browsing modes during file downloads, exposing session data to attackers.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2020-26955?
CVE-2020-26955 is a medium-severity vulnerability in Mozilla Firefox Mobile, published on 9 Dec 2020. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
When a user downloaded a file in Firefox for Android, if a cookie is set, it would have been re-sent during a subsequent file download operation on the same domain, regardless of whether the original and subsequent request were in private and non-private browsing modes. *Note: This issue only affected Firefox for Android. Other operating systems are unaffected.*. This vulnerability affects Firefox < 83.
Weakness: CWE-565
Which versions are affected by CVE-2020-26955?
It affects 1 product.
Products include Mozilla Firefox Mobile.
How do I fix CVE-2020-26955?
Upgrade to a fixed version.
Is CVE-2020-26955 being exploited?
There is no known exploitation of CVE-2020-26955 in the wild and no public exploit code.
Other vulnerabilities in Mozilla Firefox Mobile
Sources
Also known as GHSA-xvpg-g5h6-mqww, UBUNTU-CVE-2020-26955.