CVE-2020-26962 Security feature bypass in Firefox
Attackers could exploit cross-origin iframes to trigger login autofill, enabling clickjacking and cross-partition data access in Firefox.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2020-26962?
CVE-2020-26962 is a medium-severity vulnerability in Mozilla Firefox, published on 9 Dec 2020. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Cross-origin iframes that contained a login form could have been recognized by the login autofill service, and populated. This could have been used in clickjacking attacks, as well as be read across partitions in dynamic first party isolation. This vulnerability affects Firefox < 83.
Weakness: CWE-1021
Which versions are affected by CVE-2020-26962?
It affects 1 product.
Products include Mozilla Firefox.
How do I fix CVE-2020-26962?
Upgrade to a fixed version.
Is CVE-2020-26962 being exploited?
There is no known exploitation of CVE-2020-26962 in the wild and no public exploit code.
Other vulnerabilities in Mozilla Firefox
Sources
Also known as GHSA-2wfq-mq88-h9xc, UBUNTU-CVE-2020-26962.