CVE-2021-29975

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Through a series of DOM manipulations, a message, over which the attacker had control of the text but not HTML or formatting, could be overlaid on top of another domain (with the new domain correctly shown in the address bar) resulting in possible user confusion. This vulnerability affects Firefox < 90.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Affected software

No affected versions have been published.

Timeline

Published: Aug 5, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-299768.8Mozilla developers reported memory safety bugs present in code shared between Firefox and Thunderbird. Some of these bugs showed evidence of CVE-2021-299778.8Mozilla developers reported memory safety bugs present in Firefox 89. Some of these bugs showed evidence of memory corruption and we presume CVE-2021-299789.8Multiple low security issues were discovered and fixed in a security audit of Mozilla VPN 2.x branch as part of a 3rd party security audit. CVE-2021-299796.1Hubs Cloud allows users to download shared content, specifically HTML and JS, which could allow javascript execution in the Hub Cloud instan CVE-2021-299808.8Uninitialized memory in a canvas object could have caused an incorrect free() leading to memory corruption and a potentially exploitable cra CVE-2021-299818.8An issue present in lowering/register allocation could have led to obscure but deterministic register confusion failures in JITted code that CVE-2021-299826.5Due to incorrect JIT optimization, we incorrectly interpreted data from the wrong type of object, resulting in the potential leak of a singl CVE-2021-299836.5Firefox for Android could get stuck in fullscreen mode and not exit it even after normal interactions that should cause it to exit. *Note: T CVE-2021-299848.8Instruction reordering resulted in a sequence of instructions that would cause an object to be incorrectly considered during garbage collect CVE-2021-299858.8A use-after-free vulnerability in media channels could have led to memory corruption and a potentially exploitable crash. This vulnerability CVE-2021-299868.1A suspected race condition when calling getaddrinfo led to memory corruption and a potentially exploitable crash. *Note: This issue only aff CVE-2021-299876.5After requesting multiple permissions, and closing the first permission panel, subsequent permission panels will be displayed in a different