CVE-2021-23984

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

A malicious extension could have opened a popup window lacking an address bar. The title of the popup lacking an address bar should not be fully controllable, but in this situation was. This could have been used to spoof a website and attempt to trick the user into providing credentials. This vulnerability affects Firefox ESR < 78.9, Firefox < 87, and Thunderbird < 78.9.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-290

Affected software

Vendor	Product	Versions
Mozilla	Firefox ESR	>= unspecified, < 78.9
Mozilla	Firefox	>= unspecified, < 87
Mozilla	Thunderbird	>= unspecified, < 78.9

References

https://bugzilla.mozilla.org/show_bug.cgi?id=1693664Issue Tracking, Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2021-10/Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2021-11/Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2021-12/Vendor Advisory
https://bugzilla.mozilla.org/show_bug.cgi?id=1693664Issue Tracking, Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2021-10/Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2021-11/Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2021-12/Vendor Advisory

Timeline

Published: Mar 31, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-239856.5If an attacker is able to alter specific about:config values (for example malware running on the user's computer), the Devtools remote debug CVE-2021-239866.5A malicious extension with the 'search' permission could have installed a new search engine whose favicon referenced a cross-origin URL. The CVE-2021-239878.8Mozilla developers and community members reported memory safety bugs present in Firefox 86 and Firefox ESR 78.8. Some of these bugs showed e CVE-2021-239888.8Mozilla developers reported memory safety bugs present in Firefox 86. Some of these bugs showed evidence of memory corruption and we presume CVE-2021-23994.9Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL). Supported versions that are affected are 8.0.25 and prio CVE-2021-239916.8If a Thunderbird user has previously imported Alice's OpenPGP key, and Alice has extended the validity period of her key, but Alice's update CVE-2021-239924.3Thunderbird did not check if the user ID associated with an OpenPGP key has a valid self signature. An attacker may create a crafted version CVE-2021-239936.5An attacker may perform a DoS attack to prevent a user from sending encrypted email to a correspondent. If an attacker creates a crafted Ope CVE-2021-239948.8A WebGL framebuffer was not initialized early enough, resulting in memory corruption and an out of bound write. This vulnerability affects F CVE-2021-239958.8When Responsive Design Mode was enabled, it used references to objects that were previously freed. We presume that with enough effort this c CVE-2021-239966.5By utilizing 3D CSS in conjunction with Javascript, content could have been rendered outside the webpage's viewport, resulting in a spoofing CVE-2021-239978.8Due to unexpected data type conversions, a use-after-free could have occurred when interacting with the font cache. We presume that with eno