Information disclosure in Mozilla Firefox and Firefox ESR - CVE-2020-26965

Detailed vulnerability description

The vulnerability allows a local user to gain access to potentially sensitive information.

The vulnerability exists due to the way software keyboards are handled by the Firefox. Some websites have a feature "Show Password" where clicking a button will change a password field into a textbook field, revealing the typed password. If, when using a software keyboard that remembers user input, a user typed their password and used that feature, the type of the password field was changed, resulting in a keyboard layout change and the possibility for the software keyboard to remember the typed password.

A local user leverage this behavior to gain access to passwords, stored by software keyboards.

How to mitigate CVE-2020-26965

Sources

• https://www.mozilla.org/en-US/security/advisories/mfsa2020-50/
• https://www.mozilla.org/en-US/security/advisories/mfsa2020-51/