CVE-2021-29973

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Password autofill was enabled without user interaction on insecure websites on Firefox for Android. This was corrected to require user interaction with the page before a user's password would be entered by the browser's autofill functionality *This bug only affects Firefox for Android. Other operating systems are unaffected.*. This vulnerability affects Firefox < 90.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected software

No affected versions have been published.

Timeline

Published: Aug 5, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-299744.3When network partitioning was enabled, e.g. as a result of Enhanced Tracking Protection settings, a TLS error page would allow the user to o CVE-2021-299756.5Through a series of DOM manipulations, a message, over which the attacker had control of the text but not HTML or formatting, could be overl CVE-2021-299768.8Mozilla developers reported memory safety bugs present in code shared between Firefox and Thunderbird. Some of these bugs showed evidence of CVE-2021-299778.8Mozilla developers reported memory safety bugs present in Firefox 89. Some of these bugs showed evidence of memory corruption and we presume CVE-2021-299789.8Multiple low security issues were discovered and fixed in a security audit of Mozilla VPN 2.x branch as part of a 3rd party security audit. CVE-2021-299796.1Hubs Cloud allows users to download shared content, specifically HTML and JS, which could allow javascript execution in the Hub Cloud instan CVE-2021-299808.8Uninitialized memory in a canvas object could have caused an incorrect free() leading to memory corruption and a potentially exploitable cra CVE-2021-299818.8An issue present in lowering/register allocation could have led to obscure but deterministic register confusion failures in JITted code that CVE-2021-299826.5Due to incorrect JIT optimization, we incorrectly interpreted data from the wrong type of object, resulting in the potential leak of a singl CVE-2021-299836.5Firefox for Android could get stuck in fullscreen mode and not exit it even after normal interactions that should cause it to exit. *Note: T CVE-2021-299848.8Instruction reordering resulted in a sequence of instructions that would cause an object to be incorrectly considered during garbage collect CVE-2021-299858.8A use-after-free vulnerability in media channels could have led to memory corruption and a potentially exploitable crash. This vulnerability