CVE-2021-23999 Privilege escalation in Firefox
An attacker could exploit a Blob URL loading flaw to grant web content System Principal privileges, leading to privilege escalation in Firefox and Thunderbird.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2021-23999?
CVE-2021-23999 is a high-severity vulnerability in Mozilla Firefox, published on 24 Jun 2021. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
If a Blob URL was loaded through some unusual user interaction, it could have been loaded by the System Principal and granted additional privileges that should not be granted to web content. This vulnerability affects Firefox ESR < 78.10, Thunderbird < 78.10, and Firefox < 88.
Which versions are affected by CVE-2021-23999?
It affects 3 products.
Products include Mozilla Firefox, Mozilla Firefox Esr, Mozilla Thunderbird.
How do I fix CVE-2021-23999?
Upgrade to a fixed version.
Is CVE-2021-23999 being exploited?
There is no known exploitation of CVE-2021-23999 in the wild and no public exploit code.
Other vulnerabilities in Mozilla Firefox
Sources
Also known as DEBIAN-CVE-2021-23999, GHSA-f4hx-f2xg-27cv, UBUNTU-CVE-2021-23999.