CVE-2020-26966

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Searching for a single word from the address bar caused an mDNS request to be sent on the local network searching for a hostname consisting of that string; resulting in an information leak. *Note: This issue only affected Windows operating systems. Other operating systems are unaffected.*. This vulnerability affects Firefox < 83, Firefox ESR < 78.5, and Thunderbird < 78.5.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Affected software

Vendor	Product	Versions
Mozilla	Firefox	< 83
Mozilla	Firefox ESR	< 78.5
Mozilla	Thunderbird	< 78.5

References

https://bugzilla.mozilla.org/show_bug.cgi?id=1663571Issue Tracking, Permissions Required, Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2020-50/Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2020-51/Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2020-52/Vendor Advisory
https://bugzilla.mozilla.org/show_bug.cgi?id=1663571Issue Tracking, Permissions Required, Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2020-50/Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2020-51/Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2020-52/Vendor Advisory

Timeline

Published: Dec 9, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-269676.5When listening for page changes with a Mutation Observer, a malicious web page could confuse Firefox Screenshots into interacting with eleme CVE-2020-269688.8Mozilla developers reported memory safety bugs present in Firefox 82 and Firefox ESR 78.4. Some of these bugs showed evidence of memory corr CVE-2020-269698.8Mozilla developers reported memory safety bugs present in Firefox 82. Some of these bugs showed evidence of memory corruption and we presume CVE-2020-26974.9Vulnerability in the Oracle Hospitality Suites Management component of Oracle Food and Beverage Applications. Supported versions that are af CVE-2020-269708.8When reading SMTP server status codes, Thunderbird writes an integer value to a position on the stack that is intended to contain just one b CVE-2020-269718.8Certain blit values provided by the user were not properly constrained leading to a heap buffer overflow on some video drivers. This vulnera CVE-2020-269729.8The lifecycle of IPC Actors allows managed actors to outlive their manager actors; and the former must ensure that they are not attempting t CVE-2020-269738.8Certain input to the CSS Sanitizer confused it, resulting in incorrect components being removed. This could have been used as a sanitizer by CVE-2020-269748.8When flex-basis was used on a table wrapper, a StyleGenericFlexBasis object could have been incorrectly cast to the wrong type. This resulte CVE-2020-269756.5When a malicious application installed on the user's device broadcast an Intent to Firefox for Android, arbitrary headers could have been sp CVE-2020-269766.5When a HTTPS pages was embedded in a HTTP page, and there was a service worker registered for the former, the service worker could have inte CVE-2020-269776.5By attempting to connect a website using an unresponsive port, an attacker could have controlled the content of a tab while the URL bar disp