CVE-2020-26963

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

Repeated calls to the history and location interfaces could have been used to hang the browser. This was addressed by introducing rate-limiting to these API calls. This vulnerability affects Firefox < 83.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

Affected software

No affected versions have been published.

Timeline

Published
Dec 9, 2020
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2020

CVE-2020-269646.8If the Remote Debugging via USB feature was enabled in Firefox for Android on an Android version prior to Android 6.0, untrusted apps could CVE-2020-269656.5Some websites have a feature "Show Password" where clicking a button will change a password field into a textbook field, revealing the typedCVE-2020-269666.5Searching for a single word from the address bar caused an mDNS request to be sent on the local network searching for a hostname consisting CVE-2020-269676.5When listening for page changes with a Mutation Observer, a malicious web page could confuse Firefox Screenshots into interacting with elemeCVE-2020-269688.8Mozilla developers reported memory safety bugs present in Firefox 82 and Firefox ESR 78.4. Some of these bugs showed evidence of memory corrCVE-2020-269698.8Mozilla developers reported memory safety bugs present in Firefox 82. Some of these bugs showed evidence of memory corruption and we presumeCVE-2020-26974.9Vulnerability in the Oracle Hospitality Suites Management component of Oracle Food and Beverage Applications. Supported versions that are afCVE-2020-269708.8When reading SMTP server status codes, Thunderbird writes an integer value to a position on the stack that is intended to contain just one bCVE-2020-269718.8Certain blit values provided by the user were not properly constrained leading to a heap buffer overflow on some video drivers. This vulneraCVE-2020-269729.8The lifecycle of IPC Actors allows managed actors to outlive their manager actors; and the former must ensure that they are not attempting tCVE-2020-269738.8Certain input to the CSS Sanitizer confused it, resulting in incorrect components being removed. This could have been used as a sanitizer byCVE-2020-269748.8When flex-basis was used on a table wrapper, a StyleGenericFlexBasis object could have been incorrectly cast to the wrong type. This resulte
CVE-2020-26963: Medium severity, CVSS 4.3 | Vulnix