CVE-2021-23988

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Mozilla developers reported memory safety bugs present in Firefox 86. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 87.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-787

Affected software

No affected versions have been published.

Timeline

Published
Mar 31, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-23994.9Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL). Supported versions that are affected are 8.0.25 and prioCVE-2021-239916.8If a Thunderbird user has previously imported Alice's OpenPGP key, and Alice has extended the validity period of her key, but Alice's updateCVE-2021-239924.3Thunderbird did not check if the user ID associated with an OpenPGP key has a valid self signature. An attacker may create a crafted versionCVE-2021-239936.5An attacker may perform a DoS attack to prevent a user from sending encrypted email to a correspondent. If an attacker creates a crafted OpeCVE-2021-239948.8A WebGL framebuffer was not initialized early enough, resulting in memory corruption and an out of bound write. This vulnerability affects FCVE-2021-239958.8When Responsive Design Mode was enabled, it used references to objects that were previously freed. We presume that with enough effort this cCVE-2021-239966.5By utilizing 3D CSS in conjunction with Javascript, content could have been rendered outside the webpage's viewport, resulting in a spoofingCVE-2021-239978.8Due to unexpected data type conversions, a use-after-free could have occurred when interacting with the font cache. We presume that with enoCVE-2021-239986.5Through complicated navigations with new windows, an HTTP page could have inherited a secure lock icon from an HTTPS page. This vulnerabilitCVE-2021-239998.8If a Blob URL was loaded through some unusual user interaction, it could have been loaded by the System Principal and granted additional priCVE-2021-24007.5Vulnerability in the Oracle BI Publisher product of Oracle Fusion Middleware (component: E-Business Suite - XDO). Supported versions that arCVE-2021-240003.1A race condition with requestPointerLock() and setTimeout() could have resulted in a user interacting with one tab when they believed they w
CVE-2021-23988: High severity, CVSS 8.8 | Vulnix