PT-2020-16569 · Mozilla+1 · Firefox For Android+1

Muneaki Nishimura · Published 2020-11-21 · Updated 2024-12-12 · CVE-2020-26954

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Firefox for Android versions prior to 83

Description The issue allows malicious intents from other installed apps to be accepted, enabling manifests from arbitrary file paths and declaring webapp manifests for other origins. This could lead to gaining fullscreen access for UI spoofing and cross-origin attacks on targeted websites.

Recommendations For Firefox for Android versions prior to 83, update to version 83 or later to resolve the issue. As a temporary workaround, consider restricting access to webapp manifests to minimize the risk of exploitation.

Fix

Related Identifiers

ALT-PU-2020-3384

ALT-PU-2021-3368

CVE-2020-26954

OPENSUSE-SU-2024:10600-1

OPENSUSE-SU-2024:14572-1

Affected Products

Alt Linux

Firefox For Android

References · 1872

• https://bugzilla.mozilla.org/show_bug.cgi?id=1657026 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-26954 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-26954 · Security Note
• https://mozilla.org/en-US/security/advisories/mfsa2020-50/#CVE-2020-26954 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-26954 · Vendor Advisory
• https://mozilla.org/security/advisories/mfsa2020-50 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10600-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:14572-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-26954 · Security Note
• https://ubuntu.com/security/CVE-2020-26954 · Vendor Advisory
• https://suse.com/security/cve/CVE-2024-2615 · Note
• https://suse.com/security/cve/CVE-2022-38477 · Note
• https://suse.com/security/cve/CVE-2022-28282 · Note
• https://suse.com/security/cve/CVE-2020-35111 · Note
• https://suse.com/security/cve/CVE-2017-5435 · Note