Spoofing attack in Mozilla Firefox - CVE-2020-6810
Published: March 10, 2020 / Updated: March 10, 2020
Vulnerability identifier: #VU25854
CSH Severity: Low
CVSS v4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2020-6810
CWE-ID: CWE-451
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to perform spoofing attack.
After a website had entered fullscreen mode, it could have used a previously opened popup to obscure the notification that indicates the browser is in fullscreen mode. Combined with spoofing the browser chrome, this could have led to confusing the user about the current origin of the page and credential theft or other attacks.
Affected software
Mozilla Firefox
Arch Linux
firefox (Ubuntu package)
firefox (Alpine package)
Arch Linux
firefox (Ubuntu package)
firefox (Alpine package)
How to mitigate CVE-2020-6810
Install updates from vendor's website.
Mozilla Firefox - update to 74.0
firefox (Ubuntu package) - addressed in versions 74.0+build3-0ubuntu0.16.04.1, 74.0+build3-0ubuntu0.18.04.1, 74.0+build3-0ubuntu0.19.10.1
firefox (Alpine package) - update to 74.0-r0
firefox (Ubuntu package) - addressed in versions 74.0+build3-0ubuntu0.16.04.1, 74.0+build3-0ubuntu0.18.04.1, 74.0+build3-0ubuntu0.19.10.1
firefox (Alpine package) - update to 74.0-r0