CVE-2021-43540

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

WebExtensions with the correct permissions were able to create and install ServiceWorkers for third-party websites that would not have been uninstalled with the extension. This vulnerability affects Firefox < 95.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Affected software

No affected versions have been published.

Timeline

Published
Dec 8, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-435416.5When invoking protocol handlers for external protocols, a supplied parameter URL containing spaces was not properly escaped. This vulnerabilCVE-2021-435426.5Using XMLHttpRequest, an attacker could have identified installed applications by probing error messages for loading external protocols. ThiCVE-2021-435436.1Documents loaded with the CSP sandbox directive could have escaped the sandbox's script restriction by embedding additional content. This vuCVE-2021-435446.1When receiving a URL through a SEND intent, Firefox would have searched for the text, but subsequent usages of the address bar might have caCVE-2021-435456.5Using the Location API in a loop could have caused severe application hangs and crashes. This vulnerability affects Thunderbird < 91.4.0, FiCVE-2021-435464.3It was possible to recreate previous cursor spoofing attacks against users with a zoomed native cursor. This vulnerability affects ThunderbiCVE-2021-435478.2TwinOaks Computing CoreDX DDS versions prior to 5.9.1 are susceptible to exploitation when an attacker sends a specially crafted packet to fCVE-2021-435486.5Patient Information Center iX (PIC iX) Versions C.02 and C.03 receives input or data, but does not validate or incorrectly validates that thCVE-2021-435494.8A remote authenticated attacker with write access to a PI Server could trick a user into interacting with a PI Web API endpoint and redirectCVE-2021-43555.3The Welcart e-Commerce plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on the download_orderdetaCVE-2021-435506.5The use of a broken or risky cryptographic algorithm is an unnecessary risk that may result in the exposure of sensitive information, which CVE-2021-435515.4A remote attacker with write access to PI Vision could inject code into a display. Unauthorized information disclosure, modification, or del
CVE-2021-43540: Medium severity, CVSS 6.5 | Vulnix