Improper Interaction Between Multiple Correctly-Behaving Entities in Mozilla Firefox - CVE-2020-26962
Published: November 17, 2020
Vulnerability identifier: #VU48467
CSH Severity: Low
CVSS v4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2020-26962
CWE-ID: CWE-435
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists in the way cross-origin iframes supported login autofill is being performed. Cross-origin iframes that contained a login form could have been recognized by the login autofill service and populated. This could have been used in clickjacking attacks, as well as be read across partitions in dynamic first party isolation.
Affected software
Mozilla Firefox
Arch Linux
Ubuntu
firefox (Alpine package)
firefox (Ubuntu package)
Firefox for Android
Arch Linux
Ubuntu
firefox (Alpine package)
firefox (Ubuntu package)
Firefox for Android
How to mitigate CVE-2020-26962
Install updates from vendor's website.
Mozilla Firefox - update to 83.0
Firefox for Android - update to 83.0.0
firefox (Ubuntu package) - addressed in versions 83.0+build2-0ubuntu0.16.04.3, 83.0+build2-0ubuntu0.18.04.2, 83.0+build2-0ubuntu0.20.04.1, 83.0+build2-0ubuntu0.20.10.1
Firefox for Android - update to 83.0.0
firefox (Ubuntu package) - addressed in versions 83.0+build2-0ubuntu0.16.04.3, 83.0+build2-0ubuntu0.18.04.2, 83.0+build2-0ubuntu0.20.04.1, 83.0+build2-0ubuntu0.20.10.1