CVE-2020-15671

LowCVSS 3.1/10Last modified Aug 19, 2026

Description

When typing in a password under certain conditions, a race may have occured where the InputContext was not being correctly set for the input field, resulting in the typed password being saved to the keyboard dictionary. This vulnerability affects Firefox for Android < 80.

Metrics

CVSS 3.1 3.1/10CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-200 CWE-362

Affected software

Vendor	Product	Versions
Mozilla	Firefox for Android	>= unspecified, < 80

References

https://bugzilla.mozilla.org/show_bug.cgi?id=1653862Issue Tracking, Permissions Required, Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2020-39/Release Notes, Vendor Advisory
https://bugzilla.mozilla.org/show_bug.cgi?id=1653862Issue Tracking, Permissions Required, Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2020-39/Release Notes, Vendor Advisory

Timeline

Published: Oct 1, 2020
Last modified: Aug 19, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-156738.8Mozilla developers reported memory safety bugs present in Firefox 80 and Firefox ESR 78.2. Some of these bugs showed evidence of memory corr CVE-2020-156748.8Mozilla developers reported memory safety bugs present in Firefox 80. Some of these bugs showed evidence of memory corruption and we presume CVE-2020-156758.8When processing surfaces, the lifetime may outlive a persistent buffer leading to memory corruption and a potentially exploitable crash. Thi CVE-2020-156766.1Firefox sometimes ran the onload handler for SVG elements that the DOM sanitizer decided to remove, resulting in JavaScript being executed a CVE-2020-156776.1By exploiting an Open Redirect vulnerability on a website, an attacker could have spoofed the site displayed in the download file dialog to CVE-2020-156788.8When recursing through graphical layers while scrolling, an iterator may have become invalid, resulting in a potential use-after-free. This CVE-2020-156797.6An OAuth session fixation vulnerability existed in the VPN login flow, where an attacker could craft a custom login URL, convince a VPN user CVE-2020-15687.5A remote code execution vulnerability exists when Microsoft Edge PDF Reader improperly handles objects in memory. The vulnerability could co CVE-2020-156805.3If a valid external protocol handler was referenced in an image tag, the resulting broken image size could be distinguished from a broken im CVE-2020-156817.5When multiple WASM threads had a reference to a module, and were looking up exported functions, one WASM thread could have overwritten anoth CVE-2020-156826.5When a link to an external protocol was clicked, a prompt was presented that allowed the user to choose what application to open it in. An a CVE-2020-156839.8Mozilla developers and community members reported memory safety bugs present in Firefox 81 and Firefox ESR 78.3. Some of these bugs showed e