CVE-2020-26954

MediumCVSS 4.3/10Last modified Aug 19, 2026

Description

When accepting a malicious intent from other installed apps, Firefox for Android accepted manifests from arbitrary file paths and allowed declaring webapp manifests for other origins. This could be used to gain fullscreen access for UI spoofing and could also lead to cross-origin attacks on targeted websites. *Note: This issue only affected Firefox for Android. Other operating systems are unaffected.*. This vulnerability affects Firefox < 83.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Affected software

No affected versions have been published.

Timeline

Published
Dec 9, 2020
Last modified
Aug 19, 2026
NVD status
Modified

Related CVEs from 2020

CVE-2020-269556.5When a user downloaded a file in Firefox for Android, if a cookie is set, it would have been re-sent during a subsequent file download operaCVE-2020-269566.1In some cases, removing HTML elements during sanitization would keep existing SVG event handlers and therefore lead to XSS. This vulnerabiliCVE-2020-269576.5OneCRL was non-functional in the new Firefox for Android due to a missing service initialization. This could result in a failure to enforce CVE-2020-269586.1Firefox did not block execution of scripts with incorrect MIME types when the response was intercepted and cached through a ServiceWorker. TCVE-2020-269598.8During browser shutdown, reference decrementing could have occured on a previously freed object, resulting in a use-after-free, memory corruCVE-2020-26968.8Vulnerability in the Oracle Solaris product of Oracle Systems (component: Common Desktop Environment). The supported version that is affecteCVE-2020-269608.8If the Compact() method was called on an nsTArray, the array could have been reallocated without updating other pointers, leading to a potenCVE-2020-269616.5When DNS over HTTPS is in use, it intentionally filters RFC1918 and related IP ranges from the responses as these do not make sense coming fCVE-2020-269626.1Cross-origin iframes that contained a login form could have been recognized by the login autofill service, and populated. This could have beCVE-2020-269634.3Repeated calls to the history and location interfaces could have been used to hang the browser. This was addressed by introducing rate-limitCVE-2020-269646.8If the Remote Debugging via USB feature was enabled in Firefox for Android on an Android version prior to Android 6.0, untrusted apps could CVE-2020-269656.5Some websites have a feature "Show Password" where clicking a button will change a password field into a textbook field, revealing the typed