VULNERABILITY INTELLIGENCE

CVE-2020-26954

CVSS score4.3 MEDIUM

EPSS probability0.64%

CISA KEVNot currently listed

Published2020-12-09

Last modified2026-08-19

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Description

When accepting a malicious intent from other installed apps, Firefox for Android accepted manifests from arbitrary file paths and allowed declaring webapp manifests for other origins. This could be used to gain fullscreen access for UI spoofing and could also lead to cross-origin attacks on targeted websites. *Note: This issue only affected Firefox for Android. Other operating systems are unaffected.*. This vulnerability affects Firefox < 83.

Weakness classification

nvd@nist.gov: NVD-CWE-Other

Primary references

security@mozilla.org — Issue Tracking, Permissions Required, Vendor Advisory
security@mozilla.org — Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 — Issue Tracking, Permissions Required, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 — Vendor Advisory