CVE-2021-38506

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

Through a series of navigations, Firefox could have entered fullscreen mode without notification or warning to the user. This could lead to spoofing attacks on the browser UI including phishing. This vulnerability affects Firefox < 94, Thunderbird < 91.3, and Firefox ESR < 91.3.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-1021

Affected software

Vendor	Product	Versions
Mozilla	Firefox	>= unspecified, < 94
Mozilla	Thunderbird	>= unspecified, < 91.3
Mozilla	Firefox ESR	>= unspecified, < 91.3

References

https://bugzilla.mozilla.org/show_bug.cgi?id=1730750Issue Tracking, Permissions Required, Vendor Advisory
https://lists.debian.org/debian-lts-announce/2021/12/msg00030.htmlMailing List, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2022/01/msg00001.htmlMailing List, Third Party Advisory
https://security.gentoo.org/glsa/202202-03Third Party Advisory
https://security.gentoo.org/glsa/202208-14Third Party Advisory
https://www.debian.org/security/2021/dsa-5026Third Party Advisory
https://www.debian.org/security/2022/dsa-5034Third Party Advisory
https://www.mozilla.org/security/advisories/mfsa2021-48/Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2021-49/Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2021-50/Vendor Advisory
https://bugzilla.mozilla.org/show_bug.cgi?id=1730750Issue Tracking, Permissions Required, Vendor Advisory
https://lists.debian.org/debian-lts-announce/2021/12/msg00030.htmlMailing List, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2022/01/msg00001.htmlMailing List, Third Party Advisory
https://security.gentoo.org/glsa/202202-03Third Party Advisory
https://security.gentoo.org/glsa/202208-14Third Party Advisory
https://www.debian.org/security/2021/dsa-5026Third Party Advisory
https://www.debian.org/security/2022/dsa-5034Third Party Advisory
https://www.mozilla.org/security/advisories/mfsa2021-48/Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2021-49/Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2021-50/Vendor Advisory

Timeline

Published: Dec 8, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-385076.5The Opportunistic Encryption feature of HTTP2 (RFC 8164) allows a connection to be transparently upgraded to TLS while retaining the visual CVE-2021-385084.3By displaying a form validity message in the correct location at the same time as a permission prompt (such as for geolocation), the validit CVE-2021-385094.3Due to an unusual sequence of attacker-controlled events, a Javascript alert() dialog with arbitrary (although unstyled) contents could be d CVE-2021-38515.4firefly-iii is vulnerable to URL Redirection to Untrusted Site CVE-2021-385108.8The executable file warning was not presented when downloading .inetloc files, which, due to a flaw in Mac OS, can run commands on a user's CVE-2021-385117.5An issue was discovered in the tar crate before 0.4.36 for Rust. When symlinks are present in a TAR archive, extraction can create arbitrary CVE-2021-385127.5An issue was discovered in the actix-http crate before 3.0.0-beta.9 for Rust. HTTP/1 request smuggling (aka HRS) can occur, potentially lead CVE-2021-385139.8Certain NETGEAR devices are affected by authentication bypass. This affects RBK852 before 3.2.10.11, RBR850 before 3.2.10.11, RBS850 before CVE-2021-385142.7Certain NETGEAR devices are affected by authentication bypass. This affects D3600 before 1.0.0.72, D6000 before 1.0.0.72, D6100 before 1.0.0 CVE-2021-385157.5Certain NETGEAR devices are affected by denial of service. This affects R6400v2 before 1.0.4.98, R6700v3 before 1.0.4.98, R7900 before 1.0.3 CVE-2021-385169.8Certain NETGEAR devices are affected by lack of access control at the function level. This affects D6220 before 1.0.0.48, D6400 before 1.0.0 CVE-2021-385177.2Certain NETGEAR devices are affected by out-of-bounds reads and writes. This affects R6400 before 1.0.1.70, RAX75 before 1.0.4.120, RAX80 be