Mozilla · Firefox For Android · CVE-2020-15664
**Name of the Vulnerable Software and Affected Versions**
Firefox versions prior to 80
Thunderbird versions prior to 78.2
Thunderbird versions prior to 68.12
Firefox ESR versions prior to 78.2
Firefox ESR versions prior to 68.12
Firefox for Android versions prior to 80
**Description**
A malicious webpage could gain access to the InstallTrigger object by holding a reference to the `eval()` function from an about:blank window. This could allow them to prompt the user to install an extension, potentially resulting in an unintended or malicious extension being installed due to user confusion.
**Recommendations**
For Firefox versions prior to 80, update to version 80 or later.
For Thunderbird versions prior to 78.2, update to version 78.2 or later.
For Thunderbird versions prior to 68.12, update to version 68.12 or later.
For Firefox ESR versions prior to 78.2, update to version 78.2 or later.
For Firefox ESR versions prior to 68.12, update to version 68.12 or later.
For Firefox for Android versions prior to 80, update to version 80 or later.