CVE-2021-23986

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

A malicious extension with the 'search' permission could have installed a new search engine whose favicon referenced a cross-origin URL. The response to this cross-origin request could have been read by the extension, allowing a same-origin policy bypass by the extension, which should not have cross-origin permissions. This cross-origin request was made without cookies, so the sensitive information disclosed by the violation was limited to local-network resources or resources that perform IP-based authentication. This vulnerability affects Firefox < 87.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-346

Affected software

No affected versions have been published.

Timeline

Published: Mar 31, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-239878.8Mozilla developers and community members reported memory safety bugs present in Firefox 86 and Firefox ESR 78.8. Some of these bugs showed e CVE-2021-239888.8Mozilla developers reported memory safety bugs present in Firefox 86. Some of these bugs showed evidence of memory corruption and we presume CVE-2021-23994.9Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL). Supported versions that are affected are 8.0.25 and prio CVE-2021-239916.8If a Thunderbird user has previously imported Alice's OpenPGP key, and Alice has extended the validity period of her key, but Alice's update CVE-2021-239924.3Thunderbird did not check if the user ID associated with an OpenPGP key has a valid self signature. An attacker may create a crafted version CVE-2021-239936.5An attacker may perform a DoS attack to prevent a user from sending encrypted email to a correspondent. If an attacker creates a crafted Ope CVE-2021-239948.8A WebGL framebuffer was not initialized early enough, resulting in memory corruption and an out of bound write. This vulnerability affects F CVE-2021-239958.8When Responsive Design Mode was enabled, it used references to objects that were previously freed. We presume that with enough effort this c CVE-2021-239966.5By utilizing 3D CSS in conjunction with Javascript, content could have been rendered outside the webpage's viewport, resulting in a spoofing CVE-2021-239978.8Due to unexpected data type conversions, a use-after-free could have occurred when interacting with the font cache. We presume that with eno CVE-2021-239986.5Through complicated navigations with new windows, an HTTP page could have inherited a secure lock icon from an HTTPS page. This vulnerabilit CVE-2021-239998.8If a Blob URL was loaded through some unusual user interaction, it could have been loaded by the System Principal and granted additional pri