Description
If a specific sequence of actions is performed when opening a new tab, the triggering principal associated with the new tab may have been incorrect. The triggering principal is used to calculate many values, including the `Referer` and `Sec-*` headers, meaning there is the potential for incorrect security checks within the browser in addition to incorrect or misleading information sent to remote websites. *This bug only affects Firefox for Android. Other versions of Firefox are unaffected.* This vulnerability affects Firefox < 127.
Metrics
CVSS 3.1 5.3/10
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NWeakness enumeration
Affected software
| Vendor | Product | Versions |
|---|---|---|
| Mozilla | Firefox | >= unspecified, < 127 |
| mozilla | firefox | < 127 |
References
- https://bugzilla.mozilla.org/show_bug.cgi?id=1889066Exploit, Issue Tracking
- https://www.mozilla.org/security/advisories/mfsa2024-25/Vendor Advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=1889066Exploit, Issue Tracking
- https://www.mozilla.org/security/advisories/mfsa2024-25/Vendor Advisory
Timeline
- Published
- Jun 11, 2024
- Last modified
- Jun 17, 2026
- NVD status
- Analyzed