PT-2021-2992 · Mozilla+4 · Firefox+4
Irvan Kurniawan
·
Published
2021-04-19
·
Updated
2024-12-12
·
CVE-2021-24000
CVSS v2.0
5.4
Medium
| Vector | AV:N/AC:H/Au:N/C:C/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Firefox versions prior to 88
Description
A race condition with
requestPointerLock() and setTimeout() could have resulted in a user interacting with one tab when they believed they were on a separate tab. In conjunction with certain elements, such as <input type="file">, this could have led to an attack where a user was confused about the origin of the webpage and potentially disclosed information they did not intend to.Recommendations
For versions prior to 88, update to version 88 or later to resolve the issue. As a temporary workaround, consider avoiding the use of
requestPointerLock() and setTimeout() functions in conjunction with sensitive elements, such as <input type="file">, until a patch is available. Restrict access to sensitive information when using tabs to minimize the risk of exploitation.Exploit
Fix
Race Condition
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Astra Linux
Firefox
Linuxmint
Ubuntu