CVE-2021-38494

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Mozilla developers reported memory safety bugs present in Firefox 91. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 92.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-787

Affected software

No affected versions have been published.

Timeline

Published: Nov 3, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-384958.8Mozilla developers reported memory safety bugs present in Thunderbird 78.13.0. Some of these bugs showed evidence of memory corruption and w CVE-2021-384968.8During operations on MessageTasks, a task may have been removed while it was still scheduled, resulting in memory corruption and a potential CVE-2021-384976.5Through use of reportValidity() and window.open(), a plain-text validation message could have been overlaid on another origin, leading to po CVE-2021-384987.5During process shutdown, a document could have caused a use-after-free of a languages service object, leading to memory corruption and a pot CVE-2021-384998.8Mozilla developers reported memory safety bugs present in Firefox 92. Some of these bugs showed evidence of memory corruption and we presume CVE-2021-38509.1Authentication Bypass by Primary Weakness in GitHub repository adodb/adodb prior to 5.20.21.CVE-2021-385008.8Mozilla developers reported memory safety bugs present in Firefox 92 and Firefox ESR 91.1. Some of these bugs showed evidence of memory corr CVE-2021-385018.8Mozilla developers reported memory safety bugs present in Firefox 92 and Firefox ESR 91.1. Some of these bugs showed evidence of memory corr CVE-2021-385025.9Thunderbird ignored the configuration to require STARTTLS security for an SMTP connection. A MITM could perform a downgrade attack to interc CVE-2021-3850310.0The iframe sandbox rules were not correctly applied to XSLT stylesheets, allowing an iframe to bypass restrictions such as executing scripts CVE-2021-385048.8When interacting with an HTML input element's file picker dialog with webkitdirectory set, a use-after-free could have resulted, leading to CVE-2021-385056.5Microsoft introduced a new feature in Windows 10 known as Cloud Clipboard which, if enabled, will record data copied to the clipboard to the