#VU50884 Security restrictions bypass in Firefox for Android - CVE-2021-23976
Published: February 23, 2021
Vulnerability identifier: #VU50884
Vulnerability risk: Low
CVSSv4.0: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2021-23976
CWE-ID: CWE-264
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerable software:
Firefox for Android
Firefox for Android
Software vendor:
Mozilla
Mozilla
Description
The vulnerability allows a local application to escalate privileges on the system.
When accepting a malicious intent from other installed apps, Firefox for Android accepted manifests from arbitrary file paths and allowed declaring webapp manifests for other origins. This could be used to gain fullscreen access for UI spoofing and could also lead to cross-origin attacks on targeted websites.
Remediation
Install updates from vendor's website.