PT-2020-16576 · Mozilla+3 · Firefox+3

Paul Stone

·

Published

2020-11-17

·

Updated

2024-12-12

·

CVE-2020-26962

CVSS v3.1

6.1

Medium

VectorAV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions Firefox versions prior to 83
Description The issue allows cross-origin iframes with a login form to be recognized and populated by the login autofill service. This could be exploited in clickjacking attacks and also allows data to be read across partitions in dynamic first party isolation.
Recommendations For versions prior to 83, update to version 83 or later to resolve the issue. As a temporary workaround, consider disabling the login autofill service for cross-origin iframes until a patch is available. Restrict access to sensitive information in login forms to minimize the risk of exploitation.

Exploit

Fix

Clickjacking

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-1021

Related Identifiers

ALT-PU-2020-3384
ALT-PU-2021-2725
ALT-PU-2021-2881
ALT-PU-2021-3368
ALT-PU-2021-3369
ALT-PU-2022-1781
ALT-PU-2022-1782
CVE-2020-26962
OESA-2023-1673
OESA-2023-1674
OPENSUSE-SU-2024:10600-1
OPENSUSE-SU-2024:14572-1
USN-4637-1
USN-4637-2

Affected Products

Alt Linux
Firefox
Linuxmint
Ubuntu