Spoofing attack in Firefox for Android - CVE-2020-26954
Published: November 17, 2020
Vulnerability identifier: #VU48475
CSH Severity: Low
CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2020-26954
CWE-ID: CWE-451
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local application to perform spoofing attack.
The vulnerability exists due to incorrect processing of web manifests. When accepting a malicious intent from other installed apps, Firefox for Android accepted manifests from arbitrary file paths and allowed declaring webapp manifests for other origins. This could be used to gain fullscreen access for UI spoofing and could also lead to cross-origin attacks on targeted websites.
Affected software
Firefox for Android
firefox (Alpine package)
firefox (Alpine package)
How to mitigate CVE-2020-26954
Install updates from vendor's website.
Firefox for Android - update to 83.0.0