CVE-2021-43533

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

When parsing internationalized domain names, high bits of the characters in the URLs were sometimes stripped, resulting in inconsistencies that could lead to user confusion or attacks such as phishing. This vulnerability affects Firefox < 94.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Affected software

No affected versions have been published.

Timeline

Published
Dec 8, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-435348.8Mozilla developers and community members reported memory safety bugs present in Firefox 93 and Firefox ESR 91.2. Some of these bugs showed eCVE-2021-435358.8A use-after-free could have occured when an HTTP2 session object was released on a different thread, leading to memory corruption and a poteCVE-2021-435366.5Under certain circumstances, asynchronous functions could have caused a navigation to fail but expose the target URL. This vulnerability affCVE-2021-435378.8An incorrect type conversion of sizes from 64bit to 32bit integers allowed an attacker to corrupt memory leading to a potentially exploitablCVE-2021-435384.3By misusing a race in our notification code, an attacker could have forcefully hidden the notification for pages that had received full screCVE-2021-435398.8Failure to correctly record the location of live pointers across wasm instance calls resulted in a GC occurring within the call not tracing CVE-2021-43548.8The PWA for WP & AMP for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the pwaforwp_splashscreen_CVE-2021-435406.5WebExtensions with the correct permissions were able to create and install ServiceWorkers for third-party websites that would not have been CVE-2021-435416.5When invoking protocol handlers for external protocols, a supplied parameter URL containing spaces was not properly escaped. This vulnerabilCVE-2021-435426.5Using XMLHttpRequest, an attacker could have identified installed applications by probing error messages for loading external protocols. ThiCVE-2021-435436.1Documents loaded with the CSP sandbox directive could have escaped the sandbox's script restriction by embedding additional content. This vuCVE-2021-435446.1When receiving a URL through a SEND intent, Firefox would have searched for the text, but subsequent usages of the address bar might have ca
CVE-2021-43533: Medium severity, CVSS 4.3 | Vulnix