VULNERABILITY INTELLIGENCE

CVE-2020-6810

CVSS score4.3 MEDIUM

EPSS probability1.03%

CISA KEVNot currently listed

Published2020-03-25

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Description

After a website had entered fullscreen mode, it could have used a previously opened popup to obscure the notification that indicates the browser is in fullscreen mode. Combined with spoofing the browser chrome, this could have led to confusing the user about the current origin of the page and credential theft or other attacks. This vulnerability affects Firefox < 74.

Weakness classification

CWE-290: Authentication Bypass by Spoofing

Primary references

security@mozilla.org — Issue Tracking, Vendor Advisory
security@mozilla.org — Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 — Issue Tracking, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 — Vendor Advisory