CVE-2021-43538

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

By misusing a race in our notification code, an attacker could have forcefully hidden the notification for pages that had received full screen and pointer lock access, which could have been used for spoofing attacks. This vulnerability affects Thunderbird < 91.4.0, Firefox ESR < 91.4.0, and Firefox < 95.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-362

Affected software

Vendor	Product	Versions
Mozilla	Thunderbird	>= unspecified, < 91.4.0
Mozilla	Firefox ESR	>= unspecified, < 91.4.0
Mozilla	Firefox	>= unspecified, < 95

References

https://bugzilla.mozilla.org/show_bug.cgi?id=1739091Issue Tracking, Permissions Required, Vendor Advisory
https://lists.debian.org/debian-lts-announce/2021/12/msg00030.htmlMailing List, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2022/01/msg00001.htmlMailing List, Third Party Advisory
https://security.gentoo.org/glsa/202202-03Third Party Advisory
https://security.gentoo.org/glsa/202208-14Third Party Advisory
https://www.debian.org/security/2021/dsa-5026Third Party Advisory
https://www.debian.org/security/2022/dsa-5034Third Party Advisory
https://www.mozilla.org/security/advisories/mfsa2021-52/Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2021-53/Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2021-54/Vendor Advisory
https://bugzilla.mozilla.org/show_bug.cgi?id=1739091Issue Tracking, Permissions Required, Vendor Advisory
https://lists.debian.org/debian-lts-announce/2021/12/msg00030.htmlMailing List, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2022/01/msg00001.htmlMailing List, Third Party Advisory
https://security.gentoo.org/glsa/202202-03Third Party Advisory
https://security.gentoo.org/glsa/202208-14Third Party Advisory
https://www.debian.org/security/2021/dsa-5026Third Party Advisory
https://www.debian.org/security/2022/dsa-5034Third Party Advisory
https://www.mozilla.org/security/advisories/mfsa2021-52/Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2021-53/Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2021-54/Vendor Advisory

Timeline

Published: Dec 8, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-435398.8Failure to correctly record the location of live pointers across wasm instance calls resulted in a GC occurring within the call not tracing CVE-2021-43548.8The PWA for WP & AMP for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the pwaforwp_splashscreen_CVE-2021-435406.5WebExtensions with the correct permissions were able to create and install ServiceWorkers for third-party websites that would not have been CVE-2021-435416.5When invoking protocol handlers for external protocols, a supplied parameter URL containing spaces was not properly escaped. This vulnerabil CVE-2021-435426.5Using XMLHttpRequest, an attacker could have identified installed applications by probing error messages for loading external protocols. Thi CVE-2021-435436.1Documents loaded with the CSP sandbox directive could have escaped the sandbox's script restriction by embedding additional content. This vu CVE-2021-435446.1When receiving a URL through a SEND intent, Firefox would have searched for the text, but subsequent usages of the address bar might have ca CVE-2021-435456.5Using the Location API in a loop could have caused severe application hangs and crashes. This vulnerability affects Thunderbird < 91.4.0, Fi CVE-2021-435464.3It was possible to recreate previous cursor spoofing attacks against users with a zoomed native cursor. This vulnerability affects Thunderbi CVE-2021-435478.2TwinOaks Computing CoreDX DDS versions prior to 5.9.1 are susceptible to exploitation when an attacker sends a specially crafted packet to f CVE-2021-435486.5Patient Information Center iX (PIC iX) Versions C.02 and C.03 receives input or data, but does not validate or incorrectly validates that th CVE-2021-435494.8A remote authenticated attacker with write access to a PI Server could trick a user into interacting with a PI Web API endpoint and redirect