CVE-2020-26964

MediumCVSS 6.8/10Last modified Aug 19, 2026

Description

If the Remote Debugging via USB feature was enabled in Firefox for Android on an Android version prior to Android 6.0, untrusted apps could have connected to the feature and operated with the privileges of the browser to read and interact with web content. The feature was implemented as a unix domain socket, protected by the Android SELinux policy; however, SELinux was not enforced for versions prior to 6.0. This was fixed by removing the Remote Debugging via USB feature from affected devices. *Note: This issue only affected Firefox for Android. Other operating systems are unaffected.*. This vulnerability affects Firefox < 83.

Metrics

CVSS 3.1 6.8/10CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

Affected software

No affected versions have been published.

Timeline

Published: Dec 9, 2020
Last modified: Aug 19, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-269656.5Some websites have a feature "Show Password" where clicking a button will change a password field into a textbook field, revealing the typed CVE-2020-269666.5Searching for a single word from the address bar caused an mDNS request to be sent on the local network searching for a hostname consisting CVE-2020-269676.5When listening for page changes with a Mutation Observer, a malicious web page could confuse Firefox Screenshots into interacting with eleme CVE-2020-269688.8Mozilla developers reported memory safety bugs present in Firefox 82 and Firefox ESR 78.4. Some of these bugs showed evidence of memory corr CVE-2020-269698.8Mozilla developers reported memory safety bugs present in Firefox 82. Some of these bugs showed evidence of memory corruption and we presume CVE-2020-26974.9Vulnerability in the Oracle Hospitality Suites Management component of Oracle Food and Beverage Applications. Supported versions that are af CVE-2020-269708.8When reading SMTP server status codes, Thunderbird writes an integer value to a position on the stack that is intended to contain just one b CVE-2020-269718.8Certain blit values provided by the user were not properly constrained leading to a heap buffer overflow on some video drivers. This vulnera CVE-2020-269729.8The lifecycle of IPC Actors allows managed actors to outlive their manager actors; and the former must ensure that they are not attempting t CVE-2020-269738.8Certain input to the CSS Sanitizer confused it, resulting in incorrect components being removed. This could have been used as a sanitizer by CVE-2020-269748.8When flex-basis was used on a table wrapper, a StyleGenericFlexBasis object could have been incorrectly cast to the wrong type. This resulte CVE-2020-269756.5When a malicious application installed on the user's device broadcast an Intent to Firefox for Android, arbitrary headers could have been sp