CVE-2020-26964 Missing authorization in Firefox

What is CVE-2020-26964?

CVE-2020-26964 is a medium-severity missing authorization vulnerability in Mozilla Firefox Mobile, published on 9 Dec 2020. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

If the Remote Debugging via USB feature was enabled in Firefox for Android on an Android version prior to Android 6.0, untrusted apps could have connected to the feature and operated with the privileges of the browser to read and interact with web content. The feature was implemented as a unix domain socket, protected by the Android SELinux policy; however, SELinux was not enforced for versions prior to 6.0. This was fixed by removing the Remote Debugging via USB feature from affected devices. *Note: This issue only affected Firefox for Android. Other operating systems are unaffected.*. This vulnerability affects Firefox < 83.

Which versions are affected by CVE-2020-26964?

It affects 1 product.

Products include Mozilla Firefox Mobile.

How do I fix CVE-2020-26964?

Apply the vendor's patch.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2020-26964 being exploited?

There is no known exploitation of CVE-2020-26964 in the wild and no public exploit code.

Other vulnerabilities in Mozilla Firefox Mobile

• CVE-2026-84135 Other issue in Firefox Focus for Android Critical 9.8
• CVE-2024-43111 Cross-site scripting in Firefox for iOS Critical 9.8
• CVE-2023-49060 Information disclosure in Firefox for iOS Critical 9.8
• CVE-2026-92033 Privilege escalation in Firefox for Android High 8.8
• CVE-2026-84117 Privilege escalation in Firefox for Android High 8.8

All Mozilla Firefox Mobile vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-3x56-fp32-hw97, UBUNTU-CVE-2020-26964.